← All guides
6 min read
Taming risky third-party OAuth app grants
How "Sign in with Microsoft" and "Sign in with Google" create shadow-IT backdoors—and how to audit and restrict high-risk OAuth scopes.
Why OAuth grants bypass MFA
When an employee clicks "Accept" on a third-party OAuth consent screen for an AI meeting assistant or browser extension, the vendor receives an OAuth refresh token.
That token continues to read email or Drive files even if the user changes their password or uses a hardware security key.
Scopes that should trigger immediate review
Basic identity scopes (openid, email, profile, User.Read) are safe for sign-in. Scopes such as Mail.ReadWrite, Files.ReadWrite.All, Directory.ReadWrite.All, or https://mail.google.com/ grant broad read/write access to company data.
PowerShellEntra ID · Require Admin Consent for High-Risk Scopes
Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions @{PermissionGrantPoliciesAssigned = @()}Free tool
Paste OAuth scopes into the Scope Risk Explainer →No sign-up required. Free Pistos Pharos utility.