Topic starter
08/02/2026 8:25 pm
TL;DR: Microsoft Threat Intelligence saw a surge in OAuth-based attacks in 2024, with consent phishing used to bypass MFA and let attackers reach email, files and SaaS data through trusted tokens instead of stolen passwords, according to Obsidian Security. The control gap has shifted from login protection to token governance after issuance, where inventory alone cannot reveal abuse.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “OAuth Security: How to Secure OAuth Integrations”.
Key questions
Q: What breaks when OAuth tokens are stolen through a legitimate login flow?
A: Password-based phishing controls lose much of their value because the victim authenticates on real infrastructure and the attacker captures the token instead of a password.
Q: Why are OAuth tokens risky even when MFA is enforced for users?
A: MFA protects the user login, but OAuth tokens can keep working after the initial approval without repeated user authentication.
Q: What are the signs that OAuth consent governance is failing?
A: Common signs include broad scopes granted to unfamiliar applications, app registrations that survive beyond their business purpose, and consent events that are logged but not acted on.
Practitioner guidance
- Inventory OAuth grants across all SaaS tenants Map every third-party application, scope, and owner across email, collaboration, CRM, and storage platforms so you can see what has been authorised and where it can act.
- Review high-risk scopes and admin-consented apps Prioritise applications with mail, file, directory, or tenant-wide permissions, then verify whether those grants still match a documented business purpose.
- Enable behavioural detection for token abuse Baseline normal token usage by application, network source, and API pattern so new ASNs, unusual scope use, and replay activity stand out quickly.
Bottom line: OAuth creates a post-login access path that MFA does not continuously govern, which is why consent phishing and token abuse are so effective.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/10/2026 4:32 pm
OAuth token governance is now a first-class identity control: MFA and SSO stop at the point of authentication, but OAuth grants continue after authorisation. That means the control plane for SaaS risk has shifted from login to delegated access. Organisations that still treat OAuth as an application issue are governing the wrong layer; the practical conclusion is that token lifecycle oversight belongs in identity governance.
A few things that frame the scale:
- Security researchers tracked consent phishing campaigns affecting 900 tenants and 3,000 user accounts in 2025.
A question worth separating out:
Q: How should security teams govern access across SaaS sprawl?
A: Security teams should govern SaaS sprawl with one inventory, one policy model, and one review process that covers both human and non-human access. The practical goal is to connect application approval, entitlement review, and revocation to business ownership. Without that linkage, access governance becomes a manual cleanup exercise instead of a control system.
👉 Read our full editorial: OAuth token governance is the missing control for SaaS security