How to audit connected apps and OAuth consents in Microsoft 365
Every time someone clicks “Sign in with Microsoft” on a third-party site and accepts, an app can gain access to their mail, files or calendar. Attackers abuse this with consent phishing: no password is stolen, the user just approves a malicious app. This guide shows how to review what is connected to your tenant.
Why it matters
An approved app holds a token. That token can keep working after a password reset, and MFA doesn't apply to it. Most tenants carry dozens of apps nobody has reviewed since the day they were approved.
Step 1: list the apps
In the Microsoft Entra admin center, open Enterprise applications → All applications. Sort by creation date. Pay attention to anything you do not recognise.
Step 2: check what each app can do
Open an app, then Permissions. Be cautious with apps that can read or send mail, read all files, or read the whole directory. Note whether an administrator approved it for everyone, or only individual users did. Check the publisher: an unverified publisher is a reason to look closer.
Step 3: check who is allowed to approve apps
Under Enterprise applications → Consent and permissions, look at user consent settings. If users can approve any app themselves, an attacker only needs to persuade one person. Moving to admin approval, or allowing consent only for verified publishers and low-risk permissions, closes most of that gap.
Step 4: remove what you don't need
Revoke consent for apps nobody uses or can explain. Do this with the app owner when you can, because some business tools depend on their grants.
Keeping it up to date
Apps appear continuously. Zybim's Connected App Risk Auditor reviews them twice a day, read-only, and ranks the ones with sensitive access, unverified publishers or tenant-wide approval.
Want a full picture first? The free Microsoft 365 assessment also checks whether users can consent to apps.
Run the free assessmentRelated: 5 common Microsoft 365 security gaps · BEC Threat Detection