OAuth prompt=none Abuse Redirecting Off Microsoft to Attacker redirect_uri

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•2

Detects OAuth 2.0 authorization requests sent to login.microsoftonline.com using the 'prompt=none' parameter, where the redirect_uri domain is not a trusted Microsoft property. This is a common indicator of consent phishing or malicious OAuth application abuse where an attacker attempts to redirect authorization tokens to an adversary-controlled endpoint.