Eduard Arbona — identity security engineer. Contributions merged into Maester and Azure Sentinel; author of EntraTripwire.

Most people picture an account takeover as a stolen password. In Microsoft Entra ID, one of the quietest and most durable takeovers never touches the password at all. It is the illicit consent grant, and if you only watch for failed sign-ins you will miss it completely.

Here is how it works, why multi-factor authentication does not save you, and the exact signal I use to catch it.

The attack, start to finish

An attacker registers an application in their own tenant, usually multi-tenant so it can be consented from anywhere. They craft a normal OAuth 2.0 authorization URL that asks for delegated permissions such as Mail.Read , Mail.Send , Files.Read.All , and critically offline_access .

Then they phish a link. The victim clicks it and lands on the real login.microsoftonline.com page. They sign in, they pass MFA, everything looks legitimate, because it is.…