Cloud App Security can help you identify when users
authorize OAuth apps, detect risky apps, and revoke access
to them. OAuth 2.0 is the industry standard protocol for
authorization. It’s used by most major SaaS solutions as
part of the app’s identity management. When using OAuth
apps, dedicated tokens are issued that provide access to
user information and data. In order to get those tokens,
users need to authorize the app’s access to information
through a consent page when using the app for the first
time. The key is that once a token is issued, the app can
continue to access user information using this token even
when the user is logged out or the password is changed.
Over the last few years, advanced attackers developed
dedicated phishing techniques to trick users into authorizing
malicious apps and to exfiltrate their data.
Let’s take a look at how Microsoft Cloud App Security can
help you detect and manage OAuth apps in our organization.
From the primary dashboard, navigate to investigate and
then click on OAuth apps. On this page, Microsoft Cloud
App Security automatically displays all OAuth apps that
were authorized by the users in our organization. For each
app, you can see the basic information about the app, as
well as analytics for each app, such as the permission level
and community use. Let’s take DocuSign as an example.
We can see the publisher’s name and the app’s URL. When
you click on permission, you get a detailed overview of the
permissions the app has requested. And below, we see an
indicator for community use. Community use allows you
to understand how common an app is across all Microsoft
Cloud App Security tenants, so we can easily understand
whether this app is widely used in other organizations,
providing an indication of its risk if the app is rare.
At the top, you can leverage filters to focus on the most
relevant apps and use built-in queries focused on identifying
risky apps. For example, you can select rare apps with
high permissions. If you identify a suspicious app, you can
manually revoke it from the portal. Click on mark app as
banned. This will revoke access to the app for all users.
You can enter a custom message informing the user that
the app will no longer be available. In large organizations,
we often see thousands of OAuth apps, requiring security
teams to be able to automatically be notified when risky
apps are identified and potentially to automate governance.
To create a policy focused on the discovery and management
of OAuth apps, click on new policy from search.
Now, you can define a policy based on the query that we just
used. First, provide a name and optionally a description for
this policy. Further down, you will notice that the filters
align with the query that we used earlier. Lastly, you can
define how you want to be alerted and whether you want to
configure governance actions and automatically revoke the
app after it’s identified.
Finally, when you’re satisfied with the policy, click create.
From your policy overview, you can instantly navigate to
existing alerts by clicking on the menu next to the policy
and selecting view all matches.
Malicious OAuth apps are an evolving attack vector. Using
Microsoft Cloud App Security, organizations can mitigate
this threat by identifying and automatically revoking
suspicious apps.