OAuth consent policies for tenant hardening
Overview
Malicious apps trick users into consent. Restrict consent to admins or verified publishers.
Policies
- Disable user consent for risky permissions categories.
- Use admin consent workflow with approvers.
Monitoring
Alert on new enterprise applications weekly; review OAuth grants in Defender or Entra.
User education
“Don’t approve random Teams/SharePoint apps” poster tied to real examples.
Exceptions
Time-box publisher approvals for LOB dev tests in separate dev tenant ideal.
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...