[THEME] OAuth Apps

What does Attic do?

Attic monitors application consent settings and detects potentially malicious or overprivileged applications in your tenant.

The checks in this theme cover:

• Whether users can register applications themselves
• User consent policies are properly configured to limit what apps users can approve
• Detection of suspicious admin consent grants
• Admin consent flow is enabled (so requests go through proper approval)
• App registration secrets are monitored for expiry
• App registration certificate usage is reviewed
• Detection of rogue or unauthorized applications

Why is this important?

Malicious OAuth apps are increasingly used by attackers to gain persistent access to cloud environments. A user who grants consent to a malicious app unknowingly gives an attacker access to their email, files, and contacts. By restricting consent policies and monitoring app registrations, you prevent unauthorized applications from accessing your organization's data.

Checks in this theme