ConsentFix OAuth App Consent Grant with Broad Scopes by Non-Admin User
Detects instances where users grant broad permissions (e.g., Mail.Read, Files.ReadWrite) to newly registered or unknown applications. It specifically correlates these grants with device code flow authentication, a technique frequently used in OAuth consent phishing to bypass traditional authentication hurdles.
Microsoft Sentinel (KQL)
