If you manage Microsoft 365 for a small business, you've clicked "Accept" on a third-party app consent screen more times than you can count. Most of the time it's harmless — a scheduling tool, a backup connector, a helpdesk integration. But what happens when one of those trusted apps gets compromised, and it already has permissions to read every mailbox, every file, and every admin role in your tenant?
That's not a hypothetical. According to The Hacker News, attackers used a compromised ConnectWise Cloud Backup (formerly SkyKick) credential to sign into 173 separate Microsoft 365 tenants. A single third-party application identity became a master key to hundreds of businesses overnight. The fallout was serious enough that, per The Hacker News, ConnectWise had to suspend the product entirely and disable seven application identities tied to the incident.
The attacker didn't need to phish an employee or crack a password. They needed one over-permissioned app with standing access across customer tenants. That's the quiet danger of OAuth consent in M365: once an app is approved, it keeps working in the background — no MFA prompt, no login alert, nothing on your radar unless you go looking for it.
Why Enterprise App Consent Is a Blind Spot
Every time a user or admin approves a third-party integration in M365, that app receives an OAuth token with a defined scope of permissions — read mail, read files, manage users, or in the worst cases, full directory access. Those permissions don't expire when the project ends or the vendor relationship changes. They sit there, silently valid, until someone revokes them.
Most small businesses never audit this list. IT admins are focused on patching servers, managing endpoints, and responding to tickets — not combing through Entra ID's enterprise applications blade. Attackers know this. An app that self-escalated to Global Administrator rights, as described in the Reddit threads covering this breach, is exactly the kind of risk that sits invisible until it's exploited.
This is closely related to the identity and access problems we've written about before, including who should own admin credentials and access control policy and how ITDR, MFA, and conditional access work together to stop business email compromise. OAuth app consent is the missing piece in a lot of those conversations — it's a form of access that bypasses traditional login-based defenses entirely.
How to Audit Third-Party App Permissions in M365
Here's a practical, repeatable process you can run today, regardless of tenant size.
-
Open the Enterprise Applications list. In the Microsoft Entra admin center, go to Identity > Applications > Enterprise Applications. This shows every app that has been granted access to your tenant, including ones added by users without admin involvement.
-
Review permissions, not just app names. Click into each app and check "Permissions." Look specifically for anything with Directory.ReadWrite.All, RoleManagement.ReadWrite.Directory, or Mail.ReadWrite — these are high-impact scopes that can enable privilege escalation, exactly like the ConnectWise incident.
-
Check sign-in activity. Cross-reference each app against the sign-in logs. Apps with no recent legitimate use but active credentials are prime candidates for removal.
-
Identify who approved it and why. If you can't tie an app to a current, documented business need, treat it as unauthorized until proven otherwise.
-
Revoke or restrict access. Remove unused or high-risk apps outright. For apps you need to keep, use admin consent workflows and restrict user consent settings so employees can't approve new high-permission apps without review.
-
Enable ongoing monitoring. Set a recurring calendar reminder — monthly for MSPs managing multiple tenants, quarterly at minimum for standalone small businesses — to repeat this audit. OAuth consent sprawl happens gradually, not all at once.
-
Lock down future consent. In Entra ID, restrict user consent to verified publishers only and route all other requests through admin approval. This single setting would have blocked a huge percentage of the shadow-app risk that led to incidents like this.
This Isn't Just a ConnectWise Problem
It's tempting to read these headlines and think "we don't use ConnectWise, we're fine." That misses the point. The mechanism — a trusted vendor application with excessive standing permissions, compromised once and reused across every connected tenant — applies to any RMM tool, backup vendor, CRM integration, or AI assistant with M365 access. We've seen the same pattern show up in supply chain attacks involving OAuth token theft and in how accidental credential exposure through third-party integrations quietly expands an attacker's reach. If you're a government contractor working toward CMMC Level 1, unreviewed app consent is also a documentation and access-control gap that assessors will flag.
The lesson from the ConnectWise/SkyKick breach isn't "don't trust vendors." It's "don't let trust substitute for verification." Every app with a token in your tenant is a standing door into your environment. The only way to know which doors are open is to check.
Take Action
Attackers don't wait for you to get around to the audit — they're actively scanning for over-permissioned apps and stale OAuth grants right now. Running a proactive scan catches these gaps before they're exploited, not after. Oscar Six Security's Radar scan ($99) checks your environment for exactly this kind of exposure, alongside other common misconfigurations that attackers rely on. Check out our Radar solution and get ahead of the next headline. Focus Forward. We've Got Your Six.