tl;dr
- This post (Part 1) gives a quick risk read on Software-as-a-Service (SaaS) applications integrated with Microsoft Entra. Use the five questions below to identify where SaaS app governance is missing and where OAuth app exposure is most likely concentrated.
- Part 2 provides the response playbook. We’ll cover the technicals on how to both prevent and respond to SaaS app abuse.
- OAuth apps are now a primary attack path in Entra. Attackers increasingly bypass passwords and MFA by abusing trusted applications, delegated consent, and service principals.
- SaaS app sprawl is the norm and it hides material risk. Many organizations have hundreds to thousands of apps, with unclear ownership, unknown business justification, and inconsistent governance.
- Consent is the new credential. A single malicious or over-privileged consent can grant persistent access that survives password resets and MFA enforcement, especially when refresh tokens and app permissions are in play.
Introduction
In many Microsoft Entra environments, we’re seeing the same pattern repeat: SaaS sprawl is driving OAuth sprawl. Every time the business connects a SaaS product to Entra via SSO, OAuth consent, or an integration it typically creates and relies on an application object in Entra that carries permissions, tokens, and trust.
The result is an expanding inventory of OAuth applications that represent SaaS integrations, often without clear ownership or governance. Organizations frequently can’t confidently answer what these apps are, who created them, why they exist, or what access they hold.
This observation is not unique to Team Invictus. Palo Alto Networks Unit 42 reported that SaaS applications were relevant in over 170 (23%) of their IR cases in 2025, underscoring how often trusted apps now show up in real intrusions.
To give you an idea of the scale: a recent SaaS exposure assessment by Invictus showed that an organization with approximately 20,000 users had nearly 1,200 registered applications in their tenant. In another Invictus engagement, an organization with just 400 users had over 200 applications. OAuth applications have quietly become one of the largest risks in Microsoft Entra environments.
In this post, we frame the OAuth risk landscape and the consent epidemic, then provide a five-question checklist to pressure-test your SaaS exposure. In Part 2, we shift from awareness to action. Your organization can begin to technically assess SaaS applications during or after an incident, identify dangerous permissions, and investigate suspicious activity similar to the Salesloft Drift breach and the Midnight Blizzard (a.k.a. APT29) campaign.
This Isn’t Theoretical: OAuth Abuse in the Wild
For many, the idea of an OAuth attack feels like a theoretical threat. It is something that could happen but probably won't. The reality is far more sobering. In 2025, we witnessed one of the most significant shifts in the threat landscape as attackers moved from trying to steal passwords to hijacking the "trust" between platforms.
The OAuth Landscape
OAuth applications are the glue of the modern cloud, enabling services like ServiceNow, ChatGPT, and Snowflake to function without sharing passwords.
- The Benefit: Seamless data access through delegated or application-level permissions.
- The Risk: Attackers do not need a password if they can trick a user or administrator into approving a malicious consent request. Once granted, access can persist even if the password is changed or MFA is enabled.
The risk is becoming even greater. Many SaaS apps now incorporate AI features (e.g., ChatGPT integrations for data analysis or automation), which often require even broader permissions to process vast datasets like emails, files, or user analytics. This expands the attack surface, as a compromised AI-enabled app has a lot of write permissions into the tenant.
The Consent Epidemic
If you’ve been managing Entra ID for more than a few years, you likely remember the wild west era. In the early days, Microsoft’s default posture was heavily weighted toward productivity over protection. By default, any user could consent to applications accessing their own data.
While that seems helpful for say, onboarding a new calendar app, it creates a massive invisible 'Consent Epidemic'. It works because the friction is gone:
Need a calendar app? Click Accept.
Testing out the latest AI tool? Click Accept.
Integrating a file-sharing service? Click Accept.
While Microsoft has since course-corrected introducing more security, the damage from that early productivity first era has already been done. The ease of acceptance back then led to an epidemic of over-privileged apps that still exist in tenants today. Most organizations are sitting on a shadow registry of permissions they don't even know they have. This legacy epidemic manifests in three core risks that remain active threats today:
Checklist: 5 Questions That Matter
SaaS security fails rarely happen because teams don’t care. They happen because ownership is unclear, controls are fragmented, and risk lives in the seams between vendors, admins, and business units.
This checklist is built to close that gap. It frames the highest-impact SaaS risks as clear, board-ready questions that drive decisions: what’s acceptable and what must change; all before the next incident makes the decision for you.
What’s Next?
In Part 2, we move from awareness to action: how to lock down applications and then assess Enterprise Applications during (or after) an incident. For example, pinpoint risky Graph permissions and privileged role assignments, and investigate suspicious service principal activity. If you haven’t reviewed your SaaS applications recently, there’s a strong chance you’ll uncover something unexpected.
Contact our team for a SaaS assessment and start reducing risk today!
About Invictus Incident Response
We are an incident response company and we ❤️ the cloud and specialize in supporting organizations in preparing and responding to a cyber attack. We help our clients stay undefeated!
🆘 Incident Response support reach out to cert@invictus-ir.com or go to https://www.invictus-ir.com/24-7