Consent phishing skips the password. A user is shown a real consent screen for a malicious OAuth app and clicks accept, which gives the app a token to act on their data. Defend by reviewing apps by permission, popularity and publisher, and by revoking anything that does not need what it asks for.
Why it works
OAuth lets a service act on a user's behalf without seeing the password. Microsoft's documentation notes that when users install apps, they often click accept without closely reviewing the prompt, including the permissions granted. Because the consent page is genuine, MFA does not interrupt it, and a password reset does not remove the token.
Microsoft gives an example: a consent page for an app named like a Google tool asking Google for permission looks plausible, yet a tool of that kind has no reason to request permissions from Google itself. The mismatch is the clue.
How to hunt for risky apps
Microsoft's guidance for Defender for Cloud Apps offers filters you can reproduce by hand in any identity provider.
- Apps with high severity permissions and low community use.
- Apps with email access, such as full access to all mailboxes, where you check each one truly needs mail.
- Apps authorized by external users.
- Apps authorized by only a small number of users, which can point to a compromised account.
- Apps whose permissions do not match their purpose. A clock app with full mailbox access is the stated example.
- Apps whose last authorization is old, since they may no longer be needed.
Principles for judging an app
Microsoft states three: the more common an app is, the more likely it is safe; an app should only request permissions related to its purpose; and apps needing high privilege or admin consent are more likely to be risky.
Then check the name, publisher and website. Low download counts, bad ratings, a suspicious publisher or no recent update are all warning signs.
What to do about it
- Revoke or ban the app, which removes its token.
- Look at consent activity to see which users approved it and when.
- Review what the app did using the activity log.
- Reset credentials for affected users and review inbox rules and forwarding.
- Restrict who can consent. Many identity platforms let you require admin approval for apps above a permission level.
For developer platforms, the same review exists. GitHub's documentation walks through Settings, Applications and the Authorized OAuth Apps tab, where you can revoke an app or all apps. See a real GitHub example.
Quick check
Does resetting the password remove a malicious OAuth grant?
No. The app holds its own token. You must revoke the app's access.
What is the single best control?
Require admin approval for apps that request high permissions, so a single user click cannot grant them.
Sources
- Investigate and remediate risky OAuth apps (Microsoft Learn)
- Reviewing your authorized OAuth apps (GitHub Docs)
Last reviewed: 19 October 2026.
