Why does Microsoft Defender for Cloud Apps mark some OAuth apps as ‘High Risk’ even when they come from trusted vendors?

Question

I’m noticing that in Microsoft Defender for Cloud Apps, several OAuth applications are being flagged as ‘High Risk’ even though they come from well-known vendors and have been in our tenant for a long time. The permissions don’t look unusual, and nothing was recently changed. Does anyone know what specific conditions trigger the ‘High Risk’ rating and how accurate this classification is? I’m trying to understand whether this is something we should treat as a real threat or simply a false positive

Answer 1

I’ve seen this happen before, and it’s usually not about the vendor being untrusted!

Defender for Cloud Apps rates OAuth apps mainly based on the permissions they request and how much access they could potentially have if misused. Even well-known apps can show up as ‘High Risk’ if they ask for broad scopes like reading mail, accessing files, or having offline access. It doesn’t always mean the app is unsafe, but it’s a good reminder to review the permissions and make sure the app is still needed.

In many cases it ends up being more of a caution flag than an actual threat

Answer 2

Microsoft Defender for Cloud Apps may mark some OAuth applications as ‘High Risk’ due to several factors, even if they come from trusted vendors. The classification is influenced by the following conditions:

1. Suspicious OAuth Scopes: If an OAuth app requests permissions that are deemed suspicious or excessive compared to its intended functionality, it may be flagged as high risk. This can include permissions that allow access to sensitive data or actions that could lead to data exfiltration.
2. Behavioral Anomalies: The system uses machine learning algorithms to detect unusual activities associated with the app. For example, if an app creates suspicious inbox rules or makes anomalous calls to services like Exchange, it may trigger a high-risk alert.
3. Changes in App Behavior: Even if the app has been in your tenant for a long time, any recent changes in its behavior, such as updates to its permissions or unusual access patterns, can lead to it being flagged.
4. Integration with Security Policies: The app's behavior may be evaluated against your organization's security policies, and if it does not align well, it may be marked as high risk.

Regarding the accuracy of this classification, it is essential to review the specific alerts and the context in which they were generated. Some flags may indeed be false positives, especially if the app's behavior can be justified or if it is functioning as intended without any security breaches. Therefore, it is advisable to investigate the flagged apps further and assess whether the detected behaviors are legitimate or pose a real threat.

---

References:

• Investigate OAuth application attack paths in Defender for Cloud Apps (Preview)
• Microsoft Defender for Cloud Apps overview
• Manage OAuth apps