Entra ID OAuth App Consent Phishing - Delegated Mail/Files/Contacts Scope Grant T1528

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects when a user or administrator grants consent to an Azure AD or Office 365 application for permissions that provide significant access to mail, files, contacts, or directory data. This activity is a common vector for illicit OAuth consent attacks, where adversaries gain persistent access to sensitive data without requiring direct user credentials.