Bulk OAuth2PermissionGrant for Sensitive Scopes

Ankit Mehta@Secvyn

•updated Jun 17, 2026•2•0•2

This rule detects when a user successfully grants five or more OAuth2 permissions within a five-minute window, specifically looking for sensitive scopes such as 'Mail.Read', 'Calendar.Read', 'User.Read.All', or 'Directory.Read.All'. This behavior can indicate an adversary attempting to gain broad access to an organization's data through a compromised application or user account.