Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000010

Microsoft Entra app with risky write permissions

Critical
Entra ID
Collection Defense Evasion
v45

Signature Identity

CTD-000010
Threat ID
45
Version
IOE
Indicator Type

Threat Description

Apps with risky permissions pose a threat to your Microsoft Entra tenant. Threat actors can use such Microsoft Entra apps for long-term lowered visibility access to contacts, mail, notes, mailbox settings, user directory, and files. Write permissions allow a threat actor to modify your environment to inflict damage or establish persistence. Microsoft describes the consent grant attack:

  • An attacker registers an app with an OAuth 2.0 provider, such as Microsoft Entra ID.
  • The app is configured in a way that makes it seem legitimate. For example, attackers might use the name of a popular product available in the same ecosystem.
  • The attacker gets a link directly from users, which may be done through conventional email-based phishing, by compromising a non-malicious website, or through other techniques.
  • The user selects the link and is shown an authentic consent prompt asking them to grant the malicious app permissions to data.
  • If a user selects ‘Accept’, they will grant the app permissions to access sensitive data.
  • The app gets an authorization code, which it redeems for an access token, and potentially a refresh token. The access token is used to make API calls on behalf of the user.
  • If the user accepts, the attacker can gain access to the user’s mails, forwarding rules, files, contacts, notes, profile, and other sensitive data and resources.

MITRE ATT&CK: Attack Tactics

Collection Defense Evasion

D3FEND: Defend Tactics

Application Configuration Hardening

Remediation

  1. To review applications with risky permissions and to revoke permissions:
      1. Sign in to the Microsoft Entra admin center as an administrator.
      2. Under Identity, click Applications > Enterprise Applications.
      3. Modify filters if required.
      4. Select an app.
      5. Review app properties.
      6. Click Permissions.
      7. Click Review permissions to revoke permissions if necessary.
    .
  2. To get a detailed report on the apps’ permissions:
      1. Sign in to the computer that you will run the script from with local administrator rights.
      2. Download or copy the Get-AzureADPSPermissions.ps1 script from GitHub to a folder from which you will run the script. This will be the same folder to which the output “permissions.csv” file will be written.
      3. Open a PowerShell session as an administrator and open the folder where you saved the script to.
      4. Connect to your directory using the Connect-AzureAD cmdlet.
      5. Run this PowerShell command: .\Get-AzureADPSPermissions.ps1 | Export-csv -Path “Permissions.csv” -NoTypeInformation.
      6. Check Permissions.csv file.
      7. In the ConsentType column (column G) search for the value “AllPrincipals“. The AllPrincipals permission allows the client application to access everyone’s content in the tenancy. Native Microsoft 365 applications need this permission to work correctly. Every non-Microsoft application with this permission should be reviewed carefully.
      8. In the Permission column (column F) review the permissions that each delegated application has to content. Look for “Read” and “Write” permission or “All” permission, and review these carefully because they may not be appropriate.
      9. Review the specific users that have consents granted. If high profile or high impact users have inappropriate consents granted, you should investigate further.
      10. In the ClientDisplayName column (column C) look for apps that seem suspicious. Apps with misspelled names, super bland names, or hacker-sounding names should be reviewed carefully.
    .
  3. To disable an application:
      1. Sign in to the Microsoft Entra admin center as the global administrator for your directory.
      2. Under Identity, click Applications > Enterprise Applications.
      3. Modify filters if required.
      4. Search for the application you want to disable a user from signing in, and select the application.
      5. Select Properties.
      6. Select No for Enabled for users to sign-in?.
      7. Select Save.

Frequently Asked Questions

What does Microsoft Entra app with risky write permissions mean?

A Microsoft Entra app with write permissions has been granted the ability to modify environment settings, potentially allowing an attacker to make unauthorized changes or establish persistence. This can occur when a threat actor registers an app with OAuth 2.0 provider and helps administrators review it to seem legitimate.

Write permissions enable an attacker to modify environment settings, potentially leading to unauthorized access or data tampering. This can result in long-term access to sensitive data such as contacts, mail, notes, mailbox settings, user directory, and files.

Attackers can use an application with write permissions to modify environment settings through the consent grant attack. This involves registering an app, helping administrators review it to seem legitimate, then getting users to grant the app permissions to access sensitive data.

Cayosoft Guardian detects Microsoft Entra apps with write permissions by continuously monitoring application permissions across your tenant. When an application is found to have write permissions, Guardian flags it as a security issue so administrators are aware of the potential threat.

Cayosoft Guardian helps reduce the risk by alerting administrators to review and revoke permissions for suspicious applications. Guardian also supports ongoing monitoring, so if an application is reconfigured later, the change is caught quickly, limiting potential damage.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Entra ID
Themes
Enterprise applications
Attack Tactics
Collection Defense Evasion
Defend Tactics
Application Configuration Hardening
Indicator Types
IOE
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical