OAuth consent phishing steals access to your Microsoft 365 account without ever touching your password. No credential to crack, no MFA prompt to intercept. The user clicks "Accept" on what looks like a normal Microsoft permission screen, and an attacker walks in through the front door your own employee held open.
It's one of the few attacks that beats multi-factor authentication by design. Here's how it works and how to shut it down.
By Joel Baum
What is OAuth consent phishing?
OAuth consent phishing tricks a user into granting a malicious third-party app permission to their Microsoft 365 account. Instead of stealing a password, the attacker asks for access, and the user approves it. The app then reads email, files, and contacts using a token Microsoft itself issued. Changing the password doesn't revoke it.
That last part is what makes it dangerous. Your usual response to a compromise, reset the password, force MFA, does nothing. The app keeps its access until someone revokes the grant.
How does it get past MFA?
MFA verifies a login. Consent phishing isn't a login. The attacker never signs in as the user; the user signs in normally and then hands a separate app permission to act on their behalf. The multi-factor check already passed, so it's never triggered again.
Proofpoint tracked a campaign where threat actors built fake Microsoft OAuth apps impersonating more than 50 well-known brands, including Adobe, DocuSign, RingCentral, SharePoint, and OneDrive. Whether the target clicked "Accept" or "Cancel," both buttons routed them onward to a counterfeit Microsoft login that captured the credentials and the session token in real time. In 2025, the Tycoon phishing kit behind attacks like these hit nearly 3,000 accounts across more than 900 Microsoft 365 environments, with a confirmed success rate above 50%.
Why do small businesses get hit?
Because the default settings favor convenience. In many Microsoft 365 tenants, any user can grant any third-party app access to their own data without an admin ever seeing the request. That default exists so employees can connect tools without filing a ticket. It also means one distracted click approves a spyware app for your whole mailbox.
Small teams feel this harder. There's rarely someone watching the app-consent logs, and the fake permission screen is a real Microsoft screen, so the usual "look for the misspelled URL" advice doesn't apply. The domain is genuinely microsoft.com. Only the app asking for access is fake.
What can an attacker do once you consent?
Whatever permissions the app requested, which is usually plenty. Read and send mail as the user. Reach files in SharePoint and OneDrive. Set inbox rules that auto-forward finance emails to an outside address and hide the evidence. From there it's a short step to business email compromise, where the attacker sits in the mailbox and reroutes a wire transfer.
This is the same endgame as session hijacking, reached a different way. The account looks fine to the user the entire time.
How do you stop OAuth consent phishing?
Take the open door away first. In the Microsoft Entra admin center, turn off unrestricted user consent so employees can't approve third-party apps on their own, then set an admin consent request workflow so requests route to IT for a quick yes or no. That single change blocks the most common version of this attack.
Then check what's already connected. Review the enterprise applications and OAuth grants in your tenant and revoke anything unfamiliar or over-permissioned. Pair it with conditional access policies and app-consent alerting so a new grant gets flagged instead of forgotten. None of this requires new software; it's configuration your Microsoft 365 licenses already include.
The one thing that won't save you is telling people to spot the fake. The screen is real. The control has to live in the tenant, not in the user's judgment.
Frequently asked questions
Does MFA protect against OAuth consent phishing?
No, and that's the point of the attack. MFA secures logins. Consent phishing rides on a legitimate login and then requests separate app permissions, so the multi-factor prompt never fires. You need consent controls in your tenant, not just MFA, to block it.
How do I know if a user granted access to a malicious app?
Check the enterprise applications and user consent logs in the Microsoft Entra admin center. Look for recently added apps, unfamiliar publishers, or broad permissions like full mailbox access. Unexpected inbox forwarding rules are another red flag worth checking during any review.
Will resetting the password fix it?
No. A granted OAuth app holds its own token and keeps access even after a password reset or MFA reset. You have to revoke the specific app consent to cut it off. That's why this attack survives the usual incident response steps.
Can I block third-party apps entirely?
You can restrict user consent so only admins approve new apps, which is the recommended setting for most small businesses. You can still allow specific vetted apps through an admin consent workflow, so employees keep the tools they need without the open-door risk.
Is this the same as a phishing email?
It usually starts with one, but the mechanism is different. Traditional phishing steals a password. Consent phishing steals authorization. That's why it bypasses MFA and survives a password change, and why the fix is tenant configuration rather than a better spam filter.
Want to know whether your Microsoft 365 tenant allows open app consent right now? Our team will check your configuration as part of a complimentary security assessment and lock down the gaps.
Joel Baum leads cybersecurity strategy at The NetSys Group, which has delivered managed IT, cybersecurity, and cloud services since 1998 to businesses across NY, NJ, CT, PA, and Southwest Florida.
Turn insight into action.
Take a free cybersecurity or AI readiness assessment, or book a call with a NetSys engineer — no obligation, no runaround.