Topic starter
23/03/2026 2:16 pm
TL;DR: Malicious Microsoft 365 applications can persist for years by using legitimate OAuth consent and application identity mechanisms, with Cyera finding long-lived apps still enabled in customer tenants and one case exposing over one million sensitive records. The governance gap is not detection speed alone, but the absence of continuous review for application identities.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “The Long-Lived Risk of Malicious OAuth Applications: A Practical Threat Hunting Guide for M365”.
Key questions
Q: What is the failure mode when malicious OAuth apps stay enabled in Microsoft 365 tenants?
A: The failure mode is lifecycle drift.
Q: Why do long-lived OAuth applications create more risk than a one-time consent event suggests?
A: Because consent is only the start of the exposure, not the end.
Q: What are the signs that Microsoft 365 compliance controls are failing in practice?
A: Common warning signs include untracked tenants, settings that drift away from the baseline, missing audit records, and changes that are not tied to a clear owner or approval trail.
Practitioner guidance
- Review all consented Microsoft 365 applications Build a recurring review process for application identities, including publisher ID, reply URL, granted scopes, and tenant prevalence.
- Revoke apps with mismatched metadata and permissions Flag applications whose name, homepage, reply URL, and permissions do not align with the stated business purpose.
- Treat disabled apps as still requiring offboarding Do not assume a disabled application is equivalent to deletion.
Bottom line: Malicious Microsoft 365 applications can remain dangerous long after consent because application identities are often left outside normal IAM review cycles.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 4:28 pm
Application identities are now a governance object, not a configuration detail. Cyera’s investigation shows that tenant hardening can coexist with a blind spot in non-human access review. The control failure is not at the login screen but in the lifecycle of consented applications, which can remain active long after their legitimacy has expired. Practitioners should treat app identity review as part of core IAM, not as an optional hunt exercise.
A few things that frame the scale:
- Security researchers tracked consent phishing campaigns affecting 900 tenants and 3,000 user accounts in 2025.
A question worth separating out:
Q: Should teams treat application identities the same way as user accounts?
A: No. User controls such as MFA and behavioural monitoring are necessary but incomplete for applications. Application identities need consent review, scope validation, publisher trust checks, and lifecycle offboarding, because their risk comes from persistent delegated access rather than interactive login behaviour.
👉 Read our full editorial: Long-lived malicious OAuth apps expose a blind spot in M365 IAM