Find risky third-party apps connected to your Microsoft 365
Every “Sign in with Microsoft” button your staff clicked may have handed an outside app access to mail, files or calendars. The Connected App Risk Auditor reviews every connected app and flags the ones holding access they shouldn't. It checks twice a day.
Included in Monitoring Plus. Read-only, with a free assessment to start.
See pricing Run a free Microsoft 365 assessmentThe breach that doesn't need a password
In a consent phishing attack, the user isn't asked for a password. They're asked to approve an app. Once approved, the app gets a token that keeps working after a password reset, and MFA never comes into play. Most tenants have dozens of connected apps nobody has reviewed since the day someone clicked “Accept”.
What the auditor flags
- Apps with sensitive permissions, such as reading or sending mail, reading all files or broad directory access
- Apps that hold application permissions, which work with no signed-in user
- Apps from unverified publishers
- Apps approved tenant-wide by an admin, especially from unverified publishers
- Apps that keep long-lived access through refresh tokens, or that many different users have consented to
- Whether users can approve third-party apps without admin approval
What you get
A ranked list of connected apps with what access each holds and why it was flagged. Each finding has the fix: revoke consent, restrict user consent settings, or require admin approval for new apps. Microsoft-managed apps are labelled as such, so you don't chase your own platform.
Read-only by design
The auditor reads app registrations and consent grants through a publisher-verified, read-only Microsoft Entra app. It never revokes or changes anything itself. You can remove its access in one click.
How to check manually (free)
- In the Microsoft Entra admin center, open Enterprise applications → All applications.
- For each app, open Permissions and review what was granted, and by whom.
- Under Enterprise applications → Consent and permissions, check whether users can consent to apps on their own.
- Repeat whenever new apps appear, or let the auditor do it for you.
Pricing
Included in Monitoring Plus, from ₹14,399 a month (about $169) for up to 50 Microsoft 365 users, with the price set by team size. See the pricing page for every band, in rupees or dollars. Monitoring Plus can also be bought through Microsoft Marketplace as a private offer; ask us.
Frequently asked questions
What is OAuth consent phishing?
An attack that tricks a user into approving a malicious app instead of entering a password. The app then accesses data through a token.
Will this break apps we rely on?
No. The auditor only reports. You decide what to revoke.
Is this the same as Defender for Cloud Apps?
No. Defender for Cloud Apps offers app governance in higher licence tiers. The auditor gives a ranked review of connected apps without needing those tiers.
How often does it check?
Twice a day.
Which plan includes it?
Monitoring Plus. It is not sold on its own.