Tenant-wide admin consent grant for openid/profile scoped to AllPrincipals

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•2

Detects the creation of an application or service principal followed quickly (within 1 hour) by a tenant-wide delegated permission grant scoped to 'AllPrincipals' with 'openid' and 'profile' permissions. This sequence is a known indicator of automated rogue Enterprise Application setup, often used in consent phishing or persistence campaigns.