TL;DR: Microsoft 365 environments can still be abused through OAuth consent and legacy protocols even when MFA, passwords, and standard identity controls are enabled, according to Abnormal AI. The real issue is control coverage and behavioral drift, not the absence of security features.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Abnormal AI's blog post: Microsoft 365 blind spots let OAuth consent and legacy authentication bypass identity controls that appear to be working.
Why it matters: IAM, IGA, and security teams need to verify that protections apply across every access path, not only the modern ones that dashboards surface.
Context
Microsoft 365 security problems often come from coverage gaps, not from absent controls. In this case, OAuth consent and legacy authentication create access paths that can remain active even when MFA, password resets, and normal identity policies are in place.
The governance issue is simple to state and hard to operationalise: policy says one thing, but the environment keeps more ways in than teams expect. That gap matters for human IAM, but it also maps to any programme that relies on tokenised access, delegated consent, or conditional enforcement across mixed protocols.
Key questions
Q: What breaks when OAuth consent is not centrally governed?
A: When consent is not centrally governed, employees can grant third-party apps persistent access to enterprise data without security review. That breaks the assumption that only procured vendors can reach sensitive systems. The result is shadow access that bypasses inventory, risk assessment, and lifecycle control, leaving identity teams blind to delegated privileges already inside the tenant.
Q: Why do legacy protocols still matter when MFA is enabled?
A: Legacy protocols such as IMAP and POP often authenticate with passwords in ways that do not inherit the same MFA enforcement as modern sign-in flows. If they remain enabled, they become alternate entry points that bypass the control stack you think is protecting the account. The risk is coverage failure, not policy failure.
Q: How can teams tell whether behavioural controls are adding value?
A: They add value when they flag activity that is technically allowed but operationally unexpected, such as unusual consent approvals, abnormal API use, or mailbox actions that do not match the account's normal pattern. If the control only repeats what policy already knows, it is not closing the blind spot this article describes.
Q: Should organisations prioritise protocol cleanup or consent governance first?
A: Prioritise the path that gives attackers the most durable access in your environment. If legacy authentication is still enabled broadly, remove or contain it first. If modern protocols are already controlled, then focus on consent grants, token lifecycle, and application review because those can persist after the password is changed.
Technical breakdown
OAuth consent creates persistent delegated access
OAuth consent grants an application scoped API access without handing the attacker the user's password. Once the user approves the request, the resulting token can remain valid independently of later password resets, because the token is tied to delegated authorisation rather than interactive authentication. In Microsoft 365, that makes consent a durable access path when users approve a malicious or misrepresented application. Traditional identity controls may log the consent event, but they do not necessarily invalidate the token until the grant itself is removed. The practical effect is persistence inside a legitimate workflow.
Practical implication: Treat consent grants as standing access and review them as part of access governance, not just threat response.
Legacy protocols bypass modern authentication expectations
Protocols such as IMAP and POP often rely on password-only authentication and may not enforce MFA in the same way as modern interactive sign-in flows. That means a valid credential can still open a mailbox or identity path that modern controls were assumed to cover. The result is a parallel authentication surface: one protected by current policy, another still operating under older assumptions. In a mixed Microsoft 365 estate, the security posture is determined by the weakest supported protocol, not the strongest configured policy.
Practical implication: Inventory every enabled legacy protocol and remove any authentication path that does not inherit your current control baseline.
Behavioural analysis detects allowed actions that are still abnormal
Configuration checks answer whether an action is permitted, but they do not answer whether the action makes sense for the identity, app, or mailbox involved. Behavioural analysis adds context by comparing consent patterns, API usage, and mailbox activity against historical norms. That matters because the attacks described here used legitimate workflows and valid access, which makes rule-only detection brittle. A policy engine can accept the action while a behavioural engine flags it as unexpected. In Microsoft 365, that distinction is what closes the gap between permitted and safe.
Practical implication: Use behavioural signals to detect abnormal consent, token use, and internal mail activity that policy alone would miss.
Threat narrative
Attacker objective: The attacker sought persistent access to Microsoft 365 workloads and a trusted internal foothold for phishing and follow-on compromise.
- Entry occurred through a Microsoft Teams interaction that presented a convincing meeting invitation and prompted the user to approve an OAuth application.
- Credential access was replaced by delegated authorisation when the user consented, issuing a token that remained valid independently of the password.
- Impact followed as the attacker retained persistent API-level access and, in the legacy-auth case, used valid credentials to send internal phishing mail from a trusted account.
Breaches seen in the wild
- Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
- SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Microsoft 365 blind spots expose a control coverage problem, not a control absence problem. The article's core lesson is that MFA, password resets, and modern identity policy can all be present while attackers still find a valid path in. That changes the governance question from 'are we protected' to 'where does protection stop applying'. Practitioners should treat full-path coverage as the real control objective.
OAuth consent is a delegated-access problem disguised as a user-interaction problem. Once a token is issued, the security question shifts away from the password and toward the lifecycle of the grant itself. That means approval events, consent scope, and app-to-API trust become part of identity governance, not just app security. Teams that do not govern delegated access are leaving persistence to user behaviour.
Legacy authentication is evidence of environment drift in identity programmes. The article shows how old protocols survive because compatibility and operational convenience outrun governance discipline. New features, unchanged defaults, and accumulated integrations create a gap between intended policy and enforced policy. The implication is that identity programmes must measure coverage, not just policy existence.
Behavioural controls now define the boundary between allowed and expected access. In environments like Microsoft 365, attackers increasingly work inside legitimate workflows, which makes static policy too blunt on its own. A named concept here is control coverage drift: the widening gap between what the control model assumes and what the environment still permits. Practitioners should use that gap as a governance signal, not an exception report.
Human IAM and NHI governance are converging on the same problem shape. User consent grants, API tokens, and legacy protocol access are all forms of standing trust that persist after the original interaction ends. The discipline changes by actor type, but the failure mode is the same: access outlives the event that justified it. Security teams should re-evaluate lifecycle, revocation, and detection together rather than as separate programmes.
From our research library:
- The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to the 2024 State of Secrets Management Survey.
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
- Read next: SaaS-to-SaaS and OAuth App Governance Guide
What this signals
Control coverage drift: Microsoft 365 environments rarely fail because a control is missing. They fail because the control is not enforced across every protocol, consent path, and integration that still exists in the tenant.
Identity teams should treat delegated consent and legacy authentication as lifecycle problems, not edge cases. The security question is whether the access path can outlive the event that created it, and whether that path is visible to review before attackers use it.
Behavioural analysis matters because policy alone cannot distinguish legitimate from expected access. Once an attacker operates inside a permitted workflow, the only reliable signal may be that the action is out of character for the identity or workload.
For practitioners
- Audit OAuth consent grants Review third-party application consents, scope levels, and token lifetimes across Microsoft 365 tenants. Pay particular attention to apps approved through collaboration channels such as Teams, where user trust can substitute for security review.
- Disable or contain legacy protocols Identify all IMAP, POP, and similar legacy authentication paths that still accept password-only login. Remove them where possible, or isolate them so they cannot bypass modern authentication and conditional access policy.
- Add behavioural detection to identity monitoring Flag abnormal consent patterns, unusual API call sequences, and internal mail activity from accounts that normally do not behave that way. Use behavioural baselines to catch legitimate-looking activity that policy alone would allow.
- Validate control coverage after every change Recheck identity surfaces whenever new Microsoft 365 features, integrations, or defaults are introduced. Coverage drift often appears when teams assume a policy change automatically applies everywhere it should.
Key takeaways
- Microsoft 365 blind spots are about incomplete enforcement across access paths, not the absence of modern identity controls.
- OAuth consent and legacy protocols can preserve access after password resets and MFA changes, which is why control coverage matters as much as control strength.
- Teams need to govern delegated grants, remove legacy authentication, and add behavioural detection to find access that remains technically valid but operationally suspicious.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Legacy IMAP and POP access paths bypass modern authentication controls in this article. |
| NHI-05 — Overprivileged NHI | OAuth consent can grant broader API access than the user intended or can later justify. | |
| NHI-07 — Long-Lived Secrets | Tokens issued from consent persist beyond password resets and remain usable until revoked. | |
| Recommendation — Remove authentication paths that do not enforce your current identity baseline. Review delegated app grants and trim consent scopes to the minimum required. Revoke stale tokens and make consent grants subject to lifecycle review. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Authenticator lifecycle and revocation map directly to the token and legacy login paths discussed here. |
| Recommendation — Apply authenticator lifecycle controls to token revocation and legacy protocol retirement. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about authorization gaps across permitted access paths. |
| Recommendation — Verify that permissions and authorizations are enforced consistently across every access surface. | ||
| MITRE ATT&CK | TA0006;TA0009 — Credential Access; Collection | The attacks leverage valid access and mailbox access to persist and collect through legitimate channels. |
| Recommendation — Map OAuth consent abuse and legacy logins to credential access and collection behaviours. | ||
Key terms
- OAuth Consent: The approval that allows an application to access resources on behalf of a user or tenant. In practice, consent can create durable access paths that outlive the original interaction if permissions are broad, unmanaged, or never reviewed. For security teams, it is both an access decision and a lifecycle event.
- Legacy authentication: Older login or protocol methods that remain in place for compatibility even after stronger controls exist. They often preserve weaker trust assumptions, which makes them attractive to attackers and difficult to defend if they are not tightly scoped and eventually retired.
- Control Coverage Drift: Control coverage drift is the gap that opens when policy says one thing but actual enforcement no longer reaches every protocol, integration, or workflow. In identity programmes, drift is what turns a well-configured control set into a partial defence that attackers can route around.
- Behavioral Detection: A monitoring approach that looks for unusual activity rather than relying only on static inventories. For SaaS integrations, it detects drift in token use, data movement, timing, and endpoint behavior so teams can spot compromise, misuse, or automation that no longer matches its expected pattern.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 27, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org