EIDAPP-011: Consent Grants Analysis
- Plataforma
- Entra ID / M365
- Categoría
- Consent
- Severidad
- High
- Pilar de Zero Trust
- Applications & Workloads (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
OAuth consent grants authorize applications to access organizational data on behalf of users (delegated) or as the application itself (application-level). Admin consent grants provide tenant-wide access for all users, while user consent grants are scoped to individual users. Malicious or excessive consent grants are a primary technique used in OAuth phishing attacks to gain persistent access to mailboxes, files, and directory data without requiring credentials.
Valor recomendado
All admin consent grants reviewed and justified. No user consent grants for high-risk permissions. Regular consent grant reviews established
Remediación
Enumerate all OAuth2 permission grants in the tenant using Microsoft Graph and categorize them as admin consent or user consent. Review admin consent grants for overly broad permissions and revoke any that are no longer justified. Investigate user consent grants for suspicious applications, particularly those requesting Mail.Read, Files.ReadWrite, or other sensitive scopes, and revoke unauthorized grants.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6
- CIS M365 Benchmark
- 5.3.1
- MITRE ATT&CK
- T1098.003