Consent Phishing: No Password Needed to Lose Access

Your password was never stolen, and someone still got access to your email. That is consent phishing. There is no fake sign-in page collecting a password. Instead, you are sent to a real consent screen, shown a list of permissions, and asked to accept them. If you do, you hand the app access yourself.

This trick is easy to miss because the screen is hosted by the legitimate identity provider, and it does show the permissions the app will receive. The problem is a malicious app behind a normal-looking request, and a person who accepts before reading it.

How consent phishing works

Consent is how you grant an application permission to access protected resources on your behalf. Different permissions allow different levels of access. Legitimate apps use this process every day. Consent phishing turns it against you.

An attacker registers an app in Microsoft Entra ID and sets it to request access to data such as contact information, email, or documents. The attacker then tricks a user into granting that consent, typically through a phishing message carrying a link.

The message only has to get you to the screen and get you to accept. For practice spotting the message that starts tricks like this, work through the Spot the Phish quiz before one lands in your inbox.

Why the permission is the access

Once consent is granted, the illicit application has account-level access to the data covered by the permissions you approved. It does not need an account in your organization to use that access. The grant itself opens the door.

So the Accept button is not a formality after sign-in. It is the decision that gives the app access to your mail, your files, or your contacts — whichever items were on the list you approved. Read it that way.

Before you click Accept

Stop and work through the request line by line.

Read every permission before accepting. Do not skim. Ask whether this app actually needs the access it is asking for. Does a simple tool need your mail and your files? If the access is wider than the job it claims to do, do not grant it.

Check whether the publisher is verified. Prefer applications from verified publishers, and still review the permissions on the prompt even then. A verified publisher is one check, not a pass on its own.

Do not trust the app name or domain alone. Names and domain URLs are not proof an app is authentic. Attackers spoof names and domains to make a malicious app look legitimate.

Treat poor spelling as a warning. Poor spelling and grammar in the message or on the consent screen is a sign of a suspicious application. On its own it is not proof, but with a broad access request, it is enough to walk away.

Our briefing on MFA fatigue attacks covers a different prompt trick — the habit is the same: slow down at the screen that grants access, and read it before you approve it.

If you already clicked Accept

Act anyway, and act on the app itself.

Changing your password is not enough. Normal remediation steps such as resetting a password or requiring multi-factor authentication are not effective against this attack type, because the consented app sits outside the organization. A reset does not remove an app you consented to.

You must revoke the app. Remove the illicit application, or revoke its permission, so the access you granted is actually taken away. An administrator can also disable the app. Either way: deal with the grant, not just the password.

Then check what else has access. Our guide to account recovery is a useful next step if you are working through an account you no longer fully trust.

Make a review part of your routine

Microsoft's guidance is to routinely audit applications and the permissions you have consented to, and confirm apps access only the data they need. No app should hold more access than its job requires.

Individual users can review their own application access and revoke privileges for suspicious apps. Make it a habit. Open your connected apps, read the list, and ask of every entry: do I recognize this, and does it still need this access? Remove anything you do not recognize.

Do that today. If an app should not be there, revoke it now — not after the next password change, because the password change alone will not do it.

Sources: Microsoft Learn — Protect against consent phishing ↗ · Microsoft Learn — Detect and remediate illicit consent grants ↗ · Microsoft Learn — App consent grant investigation ↗