Governing OAuth apps

OAuth 2.0 is a standard for delegating access to app resources. Think of it as application X getting permission to certain parts of application Y. We call the app that receives this access an OAuth app. If you’ve ever given an app permission to access or manage your name details, mailbox, and calendar information, you’ve probably used OAuth 2.0 to do so. This is also true for any PowerShell scripts that interact with the Microsoft Graph API.

This is a great advancement from the historical way of giving access, which involved handing over your username and password, giving unrestricted abilities to the app. But it has its challenges. Attackers love persistence, as you learned about when we reviewed MITRE ATT&CK in Chapter 1. OAuth apps do not require login credentials to get access, and unless access is revoked, they will continue to get delegated access. This means two of the main threats you’ll see with OAuth apps are malicious apps...