DET-MS-MCAS-002 Defender for Cloud Apps Identity config Severity: High
OAuth grants to AI apps over Microsoft identity
Detects OAuth consent grants to AI-related apps over Microsoft Entra ID, including agentic and integration applications that may receive broad data access.
Rule
# Defender for Cloud Apps — OAuth app policy
# Name: AI OAuth Grant Detection
#
# Conditions:
# - App category in (Generative AI, AI Code Generation, AI Productivity, Email integrations)
# - Permissions include any of: Mail.Read, Files.Read.All, Sites.Read.All, User.Read.All, Calendars.Read
# - App publisher verification status != Verified (broad — apply per org tolerance)
#
# Actions:
# - Alert: medium-high based on permission scope
# - Pause app if permissions include Mail.ReadWrite, Files.ReadWrite.All, or admin-consent-required
# - Notify AI Governance + Security# Defender for Cloud Apps — OAuth app policy # Name: AI OAuth Grant Detection # # Conditions: # - App category in (Generative AI, AI Code Generation, AI Productivity, Email integrations) # - Permissions include any of: Mail.Read, Files.Read.All, Sites.Read.All, User.Read.All, Calendars.Read # - App publisher verification status != Verified (broad — apply per org tolerance) # # Actions: # - Alert: medium-high based on permission scope # - Pause app if permissions include Mail.ReadWrite, Files.ReadWrite.All, or admin-consent-required # - Notify AI Governance + Security
How it works
Captures consent-based access by AI apps to Microsoft 365 data, which can carry broader risk than direct LLM use because the app retains durable access. Pair with admin-consent restriction policies.
Required data sources
- Defender for Cloud Apps (MCAS)
- Microsoft Entra ID OAuth apps inventory
Prerequisites
- MCAS connected to Entra ID
- Admin-consent workflow configured for sensitive permissions
Expected volume
Low — 0–5 events per week. Each can be high-impact.
False-positive guidance
Some legitimate enterprise AI products have these permissions intentionally; sanction them.
Tuning steps
- Maintain a sanctioned-app list with admin consent.
- Restrict user consent to low-risk permission scopes.
Framework mappings
- NIST AI RMF: GOVERN-4.1, MANAGE-2.2
- ISO/IEC 42001: 8.2
- NIST CSF: PR.AC-4, DE.CM-1