Suspicious Application Consent in Azure AD

Ankit Mehta@Secvyn

•updated Jun 30, 2026•5•0•3

This rule detects suspicious application consent activity in Azure AD. It identifies instances where a user successfully grants consent to three or more applications within a one-hour window. This behavior can indicate an adversary attempting to gain access to resources by tricking users into consenting to malicious applications.