Defender for Cloud Apps — AI application OAuth consent anomaly
Detects unusual OAuth consent grants to AI-related applications, focusing on anomalous patterns such as first-time consent to high-permission AI apps, bulk consent across multiple users, or consent to unverified AI app publishers.
Rule
# Defender for Cloud Apps — OAuth App Anomaly Policy for AI Applications
# Navigation: Defender for Cloud Apps > Policies > OAuth App Policy
#
# Policy: AI Application OAuth Consent Anomaly Detection
#
# Conditions (alert if ANY of these match):
# Condition group 1 — New high-privilege AI app consent:
# - App category: Generative AI, AI Code Generation, AI Productivity
# - Permission level: High privilege (Mail.ReadWrite, Files.ReadWrite.All,
# Sites.ReadWrite.All, User.ReadWrite.All, Directory.Read.All)
# - App first seen: within last 7 days (new app in the environment)
# - Publisher verification: Not verified
#
# Condition group 2 — Rapid consent spread:
# - App category: Generative AI, AI Code Generation, AI Productivity
# - Users who granted consent: >= 10 in 24 hours
# - Indicates viral adoption of an unapproved AI tool
#
# Condition group 3 — Admin consent to AI app:
# - App category: Generative AI, AI Code Generation, AI Productivity
# - Consent type: Admin consent (tenant-wide)
# - App NOT in sanctioned AI app list
# - Critical: admin consent grants access for ALL users
#
# Actions:
# - Alert: High severity
# - Governance action: Disable app (for admin-consent scenarios)
# - Governance action: Revoke permissions and notify user (for user-consent scenarios)
# - Notification: AI Governance team + Security Operations
# - Integration: create incident in Sentinel via MCAS connector
#
# Exceptions:
# - Sanctioned AI apps (maintained in MCAS app governance allow-list)
# - Apps with verified publisher AND explicit AI Governance approval# Defender for Cloud Apps — OAuth App Anomaly Policy for AI Applications # Navigation: Defender for Cloud Apps > Policies > OAuth App Policy # # Policy: AI Application OAuth Consent Anomaly Detection # # Conditions (alert if ANY of these match): # Condition group 1 — New high-privilege AI app consent: # - App category: Generative AI, AI Code Generation, AI Productivity # - Permission level: High privilege (Mail.ReadWrite, Files.ReadWrite.All, # Sites.ReadWrite.All, User.ReadWrite.All, Directory.Read.All) # - App first seen: within last 7 days (new app in the environment) # - Publisher verification: Not verified # # Condition group 2 — Rapid consent spread: # - App category: Generative AI, AI Code Generation, AI Productivity # - Users who granted consent: >= 10 in 24 hours # - Indicates viral adoption of an unapproved AI tool # # Condition group 3 — Admin consent to AI app: # - App category: Generative AI, AI Code Generation, AI Productivity # - Consent type: Admin consent (tenant-wide) # - App NOT in sanctioned AI app list # - Critical: admin consent grants access for ALL users # # Actions: # - Alert: High severity # - Governance action: Disable app (for admin-consent scenarios) # - Governance action: Revoke permissions and notify user (for user-consent scenarios) # - Notification: AI Governance team + Security Operations # - Integration: create incident in Sentinel via MCAS connector # # Exceptions: # - Sanctioned AI apps (maintained in MCAS app governance allow-list) # - Apps with verified publisher AND explicit AI Governance approval
How it works
Extends DET-MS-MCAS-002 with anomaly-focused conditions that catch emerging threats. While DET-MS-MCAS-002 monitors steady-state OAuth grants, this rule targets anomalous patterns: new unverified AI apps appearing for the first time, viral consent spread indicating unauthorized AI tool adoption campaigns, and admin-consent grants that give AI apps tenant-wide access. Admin consent is particularly dangerous because a single grant exposes all users' data to the AI application. The governance actions (disable app, revoke permissions) provide automated containment.
Required data sources
- Defender for Cloud Apps (MCAS) connected to Microsoft Entra ID
- Microsoft Entra ID audit logs (OAuth consent events)
- MCAS app governance feature enabled
Prerequisites
- Microsoft 365 E5 or Defender for Cloud Apps standalone
- MCAS connected to Microsoft Entra ID with app governance enabled
- Admin-consent workflow configured (users should not be able to admin-consent without approval)
- Sanctioned AI app list maintained in MCAS
Expected volume
Very low — 0-3 anomaly alerts per week. Each alert is high-value and warrants immediate investigation. Admin-consent alerts should be treated as critical.
False-positive guidance
IT teams deploying sanctioned AI tools may trigger the rapid-consent-spread condition if they roll out to many users simultaneously. Add sanctioned apps to the exception list before rollout. Some AI apps use verified publishers but request excessive permissions — review permissions regardless of publisher verification status.
Tuning steps
- Maintain the sanctioned AI app exception list — update when new AI tools are approved.
- Adjust the rapid-consent threshold (default 10 users in 24h) based on org size.
- Configure admin-consent restriction policies in Entra ID to prevent unapproved tenant-wide grants.
- Review MCAS app governance recommendations weekly for AI-categorized apps.
- Integrate with Sentinel for cross-platform correlation of AI OAuth events with network-level detections.
Framework mappings
- NIST AI RMF: GOVERN-4.1, MANAGE-2.2
- ISO/IEC 42001: 8.2, 8.4
- MITRE ATT&CK: T1550.001
- NIST CSF: DE.CM-1, DE.AE-1, PR.AC-4