Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.

4.4.3. OAuth App Policies

💡 First Principle: Consent grants are standing access that survives password resets and MFA — an ecosystem of third-party apps quietly holding tokens into your data. Watching which apps hold which permissions for how many users is identity hygiene, and OAuth app policies make the watching continuous.

The surface: MDCA's OAuth apps view (and its evolution, app governance) inventories every app granted access via consent in connected platforms (Microsoft 365, Salesforce, Google Workspace) with permission level, community prevalence, publisher, and user count. OAuth app policies alert on conditions — apps with high permission severity consented by more than N users, rare apps requesting broad scopes, newly consented apps matching risk criteria — and support governance actions: mark as approved/banned, with banned apps' tokens revoked in supported platforms. App governance (included with MDCA licensing in current bundles) deepens this for the Microsoft 365 estate: usage anomalies (an app suddenly reading 10× the mail), unused-permission detection (granted Files.ReadWrite.All, never touches files), and policy-driven auto-disable.

This closes Phase 4's loop: 4.2.3 set the front door policy (who may consent to what); OAuth app policies audit the standing estate that accumulated anyway — including grants that predate your policy, and post-compromise persistence apps (2.3.3's checklist item, now automated). Investigation flow for a flagged app: check publisher/verification, permission severity vs apparent function (a wallpaper app wanting Mail.Read is its own verdict), user spread, then ban → tokens revoked → notify affected users.

⚠️ Exam Trap: Revoking a user's sessions (2.1.5) does not revoke an app's consent grants or tokens — they're separate credentials. Cleaning up a malicious consent requires acting on the app (ban/revoke permissions/delete the service principal), which is exactly what OAuth app policies operationalize.

Reflection Question: An app named "PDF Helper" with an unverified publisher holds Mail.ReadWrite application permission, consented eight months ago, used by one account at 3 AM nightly. Walk your triage and response — and name which earlier control from 4.2.3 should have prevented the grant.

See how it connects
Alvin Varughese
Written byAlvin Varughese
Founder18 professional certifications