ConsentFix Malicious OAuth App Consent Granting Unusual Permissions

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•6

This rule detects when a user grants an OAuth application permissions within an Azure AD or Office 365 environment, specifically monitoring for highly sensitive permissions such as 'Mail.Read', 'Files.ReadWrite', 'User.Read.All', or 'offline_access'. The rule cross-references the application ID against a known list to filter out pre-authorized applications and assigns a risk score based on the combination of granted permissions, flagging suspicious, unrecognized applications.