Detection of Unusual OAuth Application Access to SharePoint and OneDrive

Adversaries increasingly leverage malicious OAuth applications to gain persistent, unauthorized access to organizational data without traditional credential theft. By tricking users into granting consent to seemingly benign or productivity-focused applications, threat actors secure OAuth tokens that permit access to Microsoft SharePoint Online and OneDrive for Business. This activity persists even if the user's password is changed or MFA is enforced. This detection targets the 'first-time' access signal, identifying new or anomalous application identifiers (AppIDs) appearing within a tenant's sign-in logs. Defenders must distinguish between legitimate third-party SaaS integrations and malicious applications used for data exfiltration or reconnaissance.

Impact

Successful exploitation allows attackers to bypass MFA and bypass conditional access policies, leading to large-scale data exfiltration, unauthorized document discovery, and long-term persistence within a target environment. This technique is frequently utilized in organized phishing campaigns to automate the harvesting of sensitive intellectual property or business communications.

Recommendation

• Implement the detection of new, unseen AppIDs interacting with SharePoint Online and OneDrive for Business to baseline and alert on anomalous consent grants.
• Review and prune high-privilege OAuth permissions such as 'Files.ReadWrite.All' or 'Sites.ReadWrite.All' that exceed organizational requirements.
• Strengthen Conditional Access policies to mandate admin consent for risky applications and block unverified publishers from accessing sensitive resources.
• Audit existing enterprise application consents to identify and revoke access for suspicious, unused, or unverified applications.