Application Consent Grant (Microsoft Entra ID)
Detects when a user or administrator grants consent to an application in Microsoft Entra ID, allowing it to access organizational data via delegated or application permissions. While often legitimate, this action can indicate potential abuse if a malicious application is granted excessive permissions and should be reviewed.
CQL · Falcon Next-Gen SIEMCopy query
#Vendor="microsoft"
| #event.module = azure
| #event.dataset = azure.entraid.audit
|Vendor.activityDisplayName ="Consent to application"
|table([source.user.name,source.ip,user_agent.original,user.full_name,Vendor.initiatedBy.user.displayName,"Vendor.targetResources[0].displayName",Vendor.initiatedBy.user.userPrincipalName])Detects when a user or administrator grants consent to an application in Microsoft Entra ID, allowing it to access organizational data via delegated or application permissions. While often legitimate, this action can indicate potential abuse if a malicious application is granted excessive permissions and should be reviewed.
application_consent_grant_microsoft_entra_id.yml
T1550
Kundan Kumar
Detection
Other
2026-05-21
2026-05-21
