Tenant-Wide Admin Consent Grant for openid/profile Scopes

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•3

Detects the granting of tenant-wide admin consent for 'openid' and 'profile' scopes to 'AllPrincipals' within an Azure environment. This activity is indicative of the final stage in a TrustSink or similar rogue External Authentication Method (EAM) attack, where an adversary configures an application to bypass user consent prompts for sensitive identity scopes.