2026 Critical Cloud Identity Detection: OAuth Application Granted Full Mailbox Access or Mail.ReadWrite Permission

Ibrahim Saud@tektrix

•updated 27 days ago•2•0•2

This rule detects when an OAuth application is granted sensitive Exchange Online permissions, such as 'full_access_as_app', 'Mail.Read', 'Mail.ReadWrite', or 'Mail.Send'. Granting these permissions allows an application to access mailboxes across the tenant without requiring a signed-in user context, which is a common persistence and data exfiltration technique used in Business Email Compromise (BEC) and espionage campaigns.