OAuth Consent Phishing:
the MFA bypass on Microsoft 365

What is happening

On 7 April 2026, ACN (Italian National Cybersecurity Agency) published through CSIRT Italia the Bulletin BL01/260407, documenting a targeted phishing campaign based on the OAuth 2.0 Device Code Grant flow against Italian Microsoft 365 and Entra ID tenants. It is the latest variant of a broader family — OAuth Consent Phishing — observed in real incidents against Italian SMEs over recent months.

The common feature is the ability to fully bypass MFA: the user authenticates normally on the genuine Microsoft page, MFA is honoured, and the OAuth token is issued after authentication to an application controlled by the attacker. From that moment, password resets or session revocations no longer stop access: an explicit grant revocation on the tenant is required.

How Consent Phishing works

Unlike classic credential phishing, OAuth Consent Phishing never asks for the password. The mechanism is straightforward:

• 1Lure — the user receives an email that appears to come from a familiar service (a productivity tool, a signature platform, a line-of-business app) with a link to an app with a credible brand.
• 2Genuine Microsoft page — the link redirects to login.microsoftonline.com. The URL is legitimate, the certificate is valid, the page is the real one. The user signs in with their credentials and MFA.
• 3Consent request — after authentication the OAuth consent screen appears: the app asks for scopes like Mail.ReadWrite, Files.ReadWrite.All, offline_access. Most users do not read permissions and click Accept.
• 4Token issuance — Microsoft issues a valid access token and refresh token. The attacker receives them and reaches the mailbox, files and tenant resources through Microsoft Graph APIs, with no password and no MFA.
• 5Persistence — the offline_access scope allows automatic access token refresh. The attacker’s session survives password changes, logout and Entra ID session revocation. The application grant itself must be revoked.

Device Code Grant: the CSIRT bulletin variant

CSIRT Bulletin BL01/260407 of 7 April 2026 describes a specific variant. The attacker contacts the user (by email, message or phone), asks them to open aka.ms/devicelogin and to enter a code that rotates every few minutes. This is the Device Code Grant flow, designed for IoT devices or terminals without a full keyboard (smart TVs, consoles, printers). When the user confirms, they actually authorise a client controlled by the attacker.

It is particularly effective because the user sees no suspicious third-party app screen: they just enter a code on a Microsoft domain. The CSIRT recommends disabling Device Code Flow for users who do not need it, through a Conditional Access policy that blocks the grant type urn:ietf:params:oauth:grant-type:device_code for every client not explicitly authorised.

Countermeasures: what to configure in Entra ID

No single measure solves the problem. What is needed is a coordinated set of configurations, nearly all at zero cost if the tenant already has a Microsoft 365 Business Standard licence:

• 1Block third-party user consent — in Entra ID, Enterprise applications → Consent and permissions → User consent settings, set Do not allow user consent. Pair it with the Admin consent workflow to avoid blocking legitimate apps.
• 2Conditional Access — requires Entra ID Premium P1. Essential policies: block access from countries outside the whitelist, require MFA for external IPs, block Device Code Flow for users who do not need it, block legacy authentication clients.
• 3Token Lifetime Policy — shorten access tokens to one hour (default: 60–90 minutes but refreshable indefinitely). The attacker is forced to re-authenticate continuously and the post-compromise access window narrows.
• 4Defender for Office 365 Plan 2 — Safe Links analyses URLs in a sandbox before the click, Safe Attachments detonates attachments. The Standard or Strict presets enable dozens of anti-phishing protections in one click. Email Security Gateway ACN adds an additional upstream layer.
• 5Block external automatic forwarding — in the Exchange Online outbound anti-spam policy set Automatic forwarding = Off. This prevents an attacker from exfiltrating email through forwarding rules pointing to external domains.
• 6Dedicated admin accounts, no mailbox — Global Administrators must be administrative accounts separate from work accounts. If Consent Phishing hits an ordinary account, the damage does not include tenant control.
• 7Training on the consent screen — the Microsoft consent screen is genuine and visually indistinguishable from a legitimate sign-in. Users must know it exists and must read the requested permissions before clicking Accept.

Monitoring: what to look for in logs

Microsoft 365 Purview Unified Audit Log records all relevant events even on base plans, with 90 days retention. Events to watch:

• Consent to application — every time a user authorises an OAuth app. Consent granted to an unknown publisher with high-privilege scopes is the clearest signal.
• New-InboxRule from foreign IP — inbox rules with obfuscated names (sequences of dots or non-alphabetic characters) are a typical signature of post-compromise BEC attacks.
• UserLoggedIn from unexpected countries — active sessions from IPs in countries where the company has no operations, especially if repeated every few hours (a pattern typical of automated scripts).
• SoftDelete and HardDelete — mass email deletion is typical of the evidence-cleanup phase.

Logs alone are not enough: real-time alerting is required. Even a simple Microsoft Sentinel rule, or an automatic notification on critical events, reduces mean time to detect from weeks to hours.

Operational support

AtWorkStudio has managed Microsoft 365 tenants for SMEs and public administration since 2000, from Piacenza, Italy. We are certified ISO/IEC 27001, 27017, 27018 and ISO 9001, with ACN QC1 qualification for three services in the Italian Public Administration Cloud Catalogue including the Email Security Gateway and the immutable Microsoft 365 backup. We are members of Clusit (Italian Association for Information Security) and associate members of Confindustria Piacenza in the RICT cluster.

If your Microsoft 365 tenant has not been hardened against OAuth Consent Phishing, we can run a targeted audit: inventory of active OAuth grants, review of User consent settings, analysis of Conditional Access policies, outbound forwarding check, review of Defender for Office 365 configuration and a phased remediation plan with no service interruption.