Detect exfiltration to unsanctioned apps by monitoring Microsoft 365 activity for unusual file sharing, downloads, and app authorisations that involve non-approved services. Correlate user behaviour, OAuth consent, and cloud access patterns to identify risky transfers. Maintain a sanctioned app list, block or limit unauthorised integrations, and investigate repeated access to sensitive content from unfamiliar destinations.
What “unsanctioned apps” means in Microsoft 365 monitoring
In practice, the question is not just “did someone upload data somewhere?” It is whether Microsoft 365 activity shows data moving into services that are outside your approved app set, approval workflow, or tenant policy. That usually shows up as sharing, file downloads, app consent, Graph access, or sync activity that lands in a cloud service you do not permit.
The detection problem is broader than a single alert. A user may move data through browser-based sharing, OAuth consent, mailbox or file access, or a third-party connector that looks legitimate on the surface. The key is to compare the destination service against your sanctioned list and then tie that destination to the user, content sensitivity, and the access path used.
For Microsoft 365 environments, the most useful starting point is the Microsoft 365 Security Guide, because it brings together the controls that matter most here: app consent, audit logs, sharing controls, and tenant hardening.
Which telemetry best reveals exfiltration to shadow or unsanctioned services?
Look for patterns that combine content movement with trust expansion. File downloads followed by uploads to unfamiliar SaaS destinations, repeated access to sensitive libraries from a new device or location, and new OAuth grants or app authorisations are all strong signals. One event on its own may be normal; the detection value comes from correlation across activity types and time.
Pay particular attention to app consent and connected-app activity. A user can legitimately read content in Microsoft 365 and still create a risky path if they authorise an app that gains broader access than the original use case. The Entra ID Applications and Consent Guide is useful here because consent abuse and risky OAuth apps often create the bridge between Microsoft 365 data and non-approved destinations.
Monitor the destination side as well as the source side. If the same account repeatedly reaches a non-sanctioned service after touching high-value content, that behaviour is often more important than a single large transfer. In Microsoft 365, unified audit, SharePoint and OneDrive activity, mailbox access, and Defender or CASB telemetry should be read together rather than as isolated logs.
The broader Data Loss Prevention (DLP) Guide is relevant because exfiltration detection improves when sharing and download telemetry are paired with content sensitivity signals, not just raw file activity.
How do you turn detection into an investigation and containment workflow?
Once you spot a suspicious destination, validate whether the app is sanctioned, whether the consent was expected, and whether the transfer involved data that should have been protected. Investigations should answer three questions quickly: what content moved, which identity or session moved it, and what permission path allowed the transfer.
Where an app is not approved, treat the event as a governance and access problem, not only a data problem. Remove or restrict the integration, review app scopes, and check whether the user granted delegated or application permissions that exceed their role. If the transfer involved sensitive material, look for similar behaviour across other users because the same app or consent pattern may be reused elsewhere.
The SaaS Security Guide helps frame the operational side of this work, especially sanctioned app management, audit log use, and shadow SaaS discovery. If the destination is an AI tool or embedded copilot rather than a general SaaS app, the Enterprise AI Copilot Security Guide is also relevant because oversharing and connector abuse can look like ordinary productivity use until data leaves the tenant.
Risk and Threat Considerations
Unsanctioned app exfiltration is risky because it bypasses your usual control assumptions. The user may still be authenticated, but the destination is outside your policy boundary, so the organisation can lose visibility into where sensitive content lands and who can access it next.
Failure mechanism: A permitted Microsoft 365 session or OAuth grant is used to move data into a non-approved service, often through sharing links, downloads, or delegated app access that looks routine in the audit trail.
Impact: Sensitive files can leave the tenant without triggering obvious perimeter alerts, and the organisation may lose control over retention, sharing, deletion, and downstream access.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack surface, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Sanctioned app control and review reduce shadow access paths to M365 data. |
| Recommendation — Review and remove unauthorized app and account access paths regularly. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | M365 exfiltration detection depends on correlating audit events across sharing, consent, and downloads. |
| AC-6 — Least Privilege | Limiting app scopes and user permissions constrains how far a risky integration can reach. | |
| Recommendation — Correlate audit records to identify unusual transfers to unsanctioned destinations. Restrict app and user permissions to the minimum needed for approved business use. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Access control is central to governing which services and integrations may receive M365 data. |
| Recommendation — Define and enforce approved access paths for Microsoft 365 data and integrations. | ||
| OWASP API Security Top 10 | API5 — Broken Function Level Authorization | Unsanctioned app access often exploits over-broad API permissions or consent scopes. |
| Recommendation — Validate app permissions so connected services can only invoke approved functions. | ||
Practitioner Guidance
What to prioritise: Build detections around the combination of content sensitivity, destination reputation, and app consent rather than around volume alone. A small transfer to an unsanctioned app can be higher risk than a large transfer to an approved business system.
What to verify: Confirm whether the destination service is on the approved app list, whether the app consent was user-granted or admin-granted, and whether the access path used a legitimate business justification. If you cannot explain all three, treat the event as suspicious until proven otherwise.
Practitioner takeaway: The best Microsoft 365 exfiltration detections focus on trust boundary breaks, not just data movement, because the real risk is often the combination of legitimate user access and illegitimate destination.
Related resources from NHI Mgmt Group
- Guide: Data Exfiltration Guide
- How should organisations control data exposure when deploying Microsoft Copilot across Microsoft 365 apps?
- Why do valid Microsoft 365 users still create data exfiltration risk?
- How do you configure tenant restrictions to stop data exfiltration to other Microsoft Entra tenants?
- How do you detect new federated domains being added in Microsoft 365?