Skip to content

Consent phishing

Also known as Illicit consent grant

Tricking a user into approving a malicious application's access to their account data.

The user sees a genuine Microsoft or Google consent screen, because the request is genuine, and approves an application that then holds a token to read their mail and files. No password is involved, so resetting it changes nothing.

Blocking or restricting user consent for unverified applications, and reviewing what is already authorized in the tenant, are the two things that address it.

Where this comes up

Consent phishing sits inside our identity and access work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.

Identity and access management Ask an engineer

Related terms

OAuth A standard for granting an application limited access to your data in another service without giving it your password. Token theft Stealing the session token issued after a successful login, letting an attacker resume the session without credentials or MFA. Phishing A fraudulent message designed to trick someone into handing over credentials, approving a login, or opening something malicious. Microsoft Entra ID Microsoft's cloud identity service, the account directory behind Microsoft 365 and thousands of connected applications.

More in identity and access

Access reviewActive DirectoryBreak-glass accountConditional accessDevice complianceDomain controllerEntra ID P2FIDO2

Back to the full glossary →

Want this explained against your own setup?

Definitions only get you so far. Book a short call and we will tell you whether this actually matters for your business, and what we would do about it.

Call (855) 737-9500 / (480) 573-3349

Email [email protected]

15-minute response on critical issues, 24/7. Onboarding in two to three weeks.

We reply within one business day. No spam, no pressure.