Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000009

Microsoft Entra app with risky read permissions

Low
Entra ID
Collection Defense Evasion
v56

Signature Identity

CTD-000009
Threat ID
56
Version
IOE
Indicator Type

Threat Description

Apps with risky permissions pose a threat to your Microsoft Entra tenant. Threat actors can use such Microsoft Entra apps for long-term lowered visibility access to contacts, mail, notes, mailbox settings, user directory, and files. Microsoft describes the consent grant attack:

  • An attacker registers an app with an OAuth 2.0 provider, such as Microsoft Entra ID.
  • The app is configured in a way that makes it seem legitimate. For example, attackers might use the name of a popular product available in the same ecosystem.
  • The attacker gets a link directly from users, which may be done through conventional email-based phishing, by compromising a non-malicious website, or through other techniques.
  • The user selects the link and is shown an authentic consent prompt asking them to grant the malicious app permissions to data.
  • If a user selects ‘Accept’, they will grant the app permissions to access sensitive data. The app gets an authorization code, which it redeems for an access token, and potentially a refresh token. The access token is used to make API calls on behalf of the user.
  • If the user accepts, the attacker can gain access to the user’s mails, forwarding rules, files, contacts, notes, profile, and other sensitive data and resources.

MITRE ATT&CK: Attack Tactics

Collection Defense Evasion

D3FEND: Defend Tactics

Application Configuration Hardening

Remediation

  1. To review applications with risky permissions and to revoke permissions:
    1. Sign in to the Microsoft Entra admin center as an administrator.
    2. Under Identity, click Applications > Enterprise Applications.
    3. Modify filters if required.
    4. Select an app.
    5. Review app properties.
    6. Click Permissions.
    7. Click Review permissions to revoke permissions if necessary.
  2. To get a detailed report on the apps’ permissions:
    1. Sign in to the computer that you will run the script from with local administrator rights.
    2. Download or copy the Get-AzureADPSPermissions.ps1 script from GitHub to a folder from which you will run the script. This will be the same folder to which the output “permissions.csv” file will be written.
    3. Open a PowerShell session as an administrator and open the folder where you saved the script to.
    4. Connect to your directory using the Connect-AzureAD cmdlet.
    5. Run this PowerShell command: .\Get-AzureADPSPermissions.ps1 | Export-csv -Path “Permissions.csv” -NoTypeInformation.
    6. Check Permissions.csv file.
    7. In the ConsentType column (column G) search for the value “AllPrincipals“. The AllPrincipals permission allows the client application to access everyone’s content in the tenancy. Native Microsoft 365 applications need this permission to work correctly. Every non-Microsoft application with this permission should be reviewed carefully.
    8. In the Permission column (column F) review the permissions that each delegated application has to content. Look for “Read” and “Write” permission or “All” permission, and review these carefully because they may not be appropriate.
    9. Review the specific users that have consents granted. If high profile or high impact users have inappropriate consents granted, you should investigate further.
    10. In the ClientDisplayName column (column C) look for apps that seem suspicious. Apps with misspelled names, super bland names, or hacker-sounding names should be reviewed carefully.
  3. To disable an application:
    1. Sign in to the Microsoft Entra admin center as the global administrator for your directory.
    2. Under Identity, click Applications > Enterprise Applications.
    3. Modify filters if required.
    4. Search for the application you want to disable a user from signing in, and select the application.
    5. Select Properties.
    6. Select No for Enabled for users to sign-in?
    7. Select Save.

Frequently Asked Questions

What does Microsoft Entra app with risky read permissions mean?

An application in your Microsoft Entra tenant has been granted unnecessary or excessive permission levels, potentially exposing sensitive data. This occurs when a user grants consent to an application that requests more access than necessary.

This issue is rated low severity because the attacker would still need additional steps to exploit the exposure, making it an indirect risk. The sensitive data remains accessible only as long as the application's permission levels remain unchanged.

Attackers can use an application with excessive read permissions to gain unauthorized access to sensitive data within your Microsoft Entra tenant, including contacts, mail, notes, mailbox settings, user directory, and files. This is achieved through a consent grant attack, where the attacker registers an app with OAuth 2.0 provider and gets users to grant excessive permissions.

Cayosoft Guardian continuously monitors the permissions granted to applications within your Microsoft Entra tenant, flagging any application found to have excessive or unnecessary permission levels as a security issue.

Cayosoft Guardian alerts administrators to review and revoke unnecessary permissions, reducing the exposure to sensitive data. Additionally, Guardian supports ongoing monitoring to catch any changes in application permission levels, limiting the duration of potential exposure.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Entra ID
Themes
Enterprise applications
Attack Tactics
Collection Defense Evasion
Defend Tactics
Application Configuration Hardening
Indicator Types
IOE
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical