OAuth consent phishing is one of the more frustrating Microsoft 365 security risks for small businesses. The attacker doesn't need to hack anything, they rely on a moment of trust and a familiar-looking permissions screen.
OAuth consent phishing is one of the more frustrating Microsoft 365 security risks for small and mid-sized businesses.
Why? Because the attacker doesn't always need to "hack" anything in the traditional sense. Instead, they rely on a moment of trust.
A staff member receives an email that looks plausible (often a shared document, a voicemail notification, or a "new Teams message"). They click, sign in, and then see what looks like a normal Microsoft permissions screen asking to "Allow" an app to access data.
If they click Accept, the business may have unintentionally granted a malicious application permission to access information — sometimes including mailboxes and files — even if Multi-Factor Authentication is enabled.
In this article we'll explain what OAuth consent phishing is, what it can lead to, and the practical settings UK SMEs should consider. We'll keep it plain-English and focused on actions you can take.
Microsoft 365 uses a modern sign-in system (Microsoft Entra ID, formerly Azure AD). When a legitimate app needs access to your Microsoft 365 data — for example, a CRM syncing calendars, or a document-signing tool reading attachments — it asks for permission.
That permission request is called consent.
Sometimes a user can grant consent themselves. Other times an administrator must approve it.
In a well-managed tenant, risky permissions are restricted so that staff can't accidentally grant an unknown app broad access. In a poorly configured tenant, a single click can grant a malicious app exactly what it needs.
Most UK SMEs have already improved their security baseline in the last few years. MFA is widely used, spam filtering is better, and staff are more aware of obvious "password reset" scams.
OAuth consent phishing can bypass some of those improvements because the consent screen is hosted by Microsoft (so it looks credible), the attacker may not need the password again once consent is granted, and the access can persist until it's revoked — even if the user changes their password.
From a business owner's perspective, the consequences are familiar: sensitive emails exposed (quotes, invoices, payroll, HR issues), OneDrive and SharePoint documents accessed, internal phishing sent from trusted accounts, and time lost investigating "how did they get in?"
These attacks evolve, but the pattern is usually consistent. Watch for:
To be clear: there are legitimate consent prompts. The red flag is when the consent appears out of nowhere or asks for access that doesn't match the user's intention.
The exact outcome depends on what permissions were granted, but common follow-on activity includes reading mailbox contents to understand suppliers, payment processes and internal language; exfiltrating attachments or SharePoint files (useful for fraud or extortion); sending convincing internal phishing from the compromised account; and setting up persistence, because the attacker may retain access through the app's permissions even after a password change.
This is why it's not enough to "reset the password and move on" after a phishing scare. If consent was granted, you also need to revoke it.
You don't need enterprise complexity to reduce this risk. For most UK SMEs, the goal is to make it hard for staff to approve risky permissions, and make it easy for IT to review and remove anything suspicious.
Here are the key areas to look at.
In Microsoft Entra ID, you can control whether users can consent to apps and what kinds of permissions they can approve.
A sensible baseline for many SMEs is that users can only consent to low-risk permissions, and/or users can only consent to apps from verified publishers.
That means even if someone clicks a malicious link, the tenant's policy can stop the dangerous consent from being granted.
If your business uses third-party apps (and most do), you don't want to block everything. You want a clear approval route.
An admin consent workflow allows staff to request an app, and IT can approve it after checking who published it, what data it wants to access, and whether it's genuinely needed.
This improves security and reduces random "shadow IT" app connections.
Most tenants accumulate apps over time: old integrations, one-off tools, and apps installed during a rushed project.
A quarterly review is usually enough for SMEs. Look for apps nobody recognises, apps with broad permissions, and apps that were added recently around the time of a phishing incident.
If in doubt, disable first and investigate impact. It's better to temporarily break a non-essential integration than to leave a data-access backdoor in place.
If you have Microsoft Defender for Office 365 (or Business Premium with relevant security features), you can investigate and remediate "illicit consent grants".
Even without advanced tooling, you should still treat "I clicked something odd" as a trigger to check sign-in logs, risky users/sign-ins, and newly added apps or consent grants.
The faster you do this, the smaller the blast radius.
Technical settings matter, but so does a repeatable human process.
Here's a lightweight approach that works well for SMEs:
Staff guidance (one paragraph): If you weren't trying to connect an app, don't approve access. Take a screenshot and report it.
IT checklist when reported: reset password (if credentials were entered), force sign-out / revoke sessions, check whether any app consent was granted and revoke if needed, review mailbox rules and forwarding, and review sign-ins for unusual locations/devices.
This is the difference between "we dealt with it" and "we stopped it properly".
At Managed Technology Group, we focus on building security that supports the business day-to-day — not security theatre. That means setting sensible Microsoft 365 consent and conditional access policies, reducing the number of risky paths attackers can use, and documenting a simple response process your team can actually follow.
In other words: Your Technology, Managed the Right Way.
If you'd like, we can do a quick Microsoft 365 security review focused specifically on app consent risk: what your current user consent settings allow, whether an admin consent workflow is in place, and a tidy-up of existing app permissions.
It's usually a small change that can prevent a disproportionately expensive incident.
Book a free IT review and we'll show you exactly where your current setup is costing you money, leaving you exposed, or slowing your team down. No obligation, no hard sell.
