Consent phishing
noun · also Illicit consent grant, OAuth consent phishing · Microsoft Learn: Protect against consent phishing
An attack that tricks a user into granting a malicious cloud app permission to their data, giving the attacker access without stealing a password.
Cloud platforms such as Microsoft 365 let users connect third-party apps to their account through OAuth: the app asks for specific permissions, such as reading mail or files, and the user clicks Accept. Consent phishing abuses that flow. The attacker registers an app with a convincing name and logo, sends a link to the real Microsoft sign-in page, and asks for broad permissions. If the user accepts, the app receives tokens that let it read the user's data directly.
No password is stolen, so resetting the password does not remove the access, and multi-factor authentication does not help because the user completed it themselves. Access lasts until someone revokes the app's permissions. Microsoft's audit logs record the grant as a Consent to application activity.
Example
A user receives an email about a shared contract and signs in on a genuine Microsoft page. A consent prompt asks for "Contract Viewer" to read their mail and files and to "maintain access to data you have given it access to." They accept. The app then downloads their mailbox every night, weeks after the email was forgotten.
Why it matters for a SOC analyst
Consent phishing survives the usual response to account compromise. When you investigate a phished account, check the apps it has consented to, and treat an unfamiliar app with mail or file permissions as an active incident: revoke its grants, review what it accessed and tighten who can consent to apps.
Related terms
- Phishing
A message that impersonates someone trustworthy to trick the recipient into clicking a link, opening a file, sharing credentials or sending money.
- Multi-factor authentication
Signing in with two or more different kinds of proof, such as a password plus a phone or security key, so a stolen password alone is not enough.
- Identity and access management
The processes and tools that manage digital identities and decide what each one can access, from account creation to removal.
- Conditional Access
Microsoft Entra ID's policy engine that decides, at each sign-in, whether to allow access, require MFA or another control, or block.
- Incident response
The organized process of detecting, analyzing, containing, eradicating and recovering from a security incident, then learning from it.