CredentialsAddAfterAdminConsentedToApp[Nobelium]

Credentials were added to an application by UserA, after the application was granted admin consent rights by UserB The Nobelium activity group has been observed adding credentials (x509 keys or password credentials) for one or more legitimate OAuth Applications or Service Principals, usually with existing Mail.Read or Mail.ReadWrite permissions, which grants the ability to read mail content from Exchange Online via Microsoft Graph or Outlook REST. Examples include mail archiving applications. See Customer Guidance on Recent Nation-State Cyber Attacks for more on the Nobelium campaign (formerly known as Solorigate). See Grant tenant-wide admin consent to an application for how to add admin consent to an application. More Nobelium-related queries can be found listed under the See also section of this document. References: https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/ https://docs.microsoft.com/azure/active-directory/manage-apps/grant-admin-consent