CoPhish Hits Copilot Studio5 Steps to Audit & Secure Your M365 OAuth Consent NOW

By CyberDudeBivash · Microsoft 365 Security · Updated: Oct 27, 2025 · Apps & Services · Playbooks · ThreatWire

TL;DR — CoPhish abuses the OAuth consent layer

Attack path: social-engineer users/builders → malicious multi-tenant app → over-scoped Graph permissions → data access & persistence via refresh tokens.
High-risk scopes: Mail.ReadWrite, Files.ReadWrite.All, offline_access, Chat.Read/ChannelMessage.Read.All, User.Read.All.
Fix in 60 minutes: discover risky apps, block self-service consent, quarantine tokens, re-consent only whitelisted publishers, and monitor Copilot Studio connectors.

CyberDudeBivash®

CyberDudeBivash — OAuth Risk Audit
Tenant-wide app inventory, scope review, Graph detections.Endpoint/XDR Suite
Detect token theft & suspicious Graph usage.Immutable Audit Logs
WORM storage for Entra & M365 audit evidence.

Disclosure: We may earn commissions from partner links. Curated by CyberDudeBivash.Table of Contents

Step 1 — Discover All OAuth Apps (Tenant-Wide)

Inventory every enterprise and service principal, including Copilot Studio/Power Platform apps and custom registrations.

PowerShell (Microsoft Graph PowerShell SDK)

# Connect with least-privileged admin and consent to Directory.Read.All when prompted
Connect-MgGraph -Scopes "Application.Read.All Directory.Read.All AuditLog.Read.All"

# 1) List apps & risky scopes
$apps = Get-MgServicePrincipal -All
$highRisk = @("Mail.ReadWrite","Files.ReadWrite.All","offline_access","Chat.Read","ChannelMessage.Read.All","User.Read.All")
$find = $apps | ForEach-Object {
  $p = Get-MgServicePrincipalOauth2PermissionGrant -ServicePrincipalId $_.Id -All -ErrorAction SilentlyContinue
  foreach($g in $p){ [PSCustomObject]@{ App=$_ .DisplayName; SpId=$_.Id; Scope=$g.Scope; ConsentType=$g.ConsentType; PrincipalId=$g.PrincipalId } }
}
$find | Where-Object { $highRisk -match $_.Scope } | Format-Table -Auto

Tip: Export to CSV and tag unknown publishers for review.

Step 2 — Lock Consent & Enforce Publisher Verification

Disable user consent for unverified apps; route requests to admin workflow.
Require Publisher Verification and App Consent Policies for high-privilege scopes.
Restrict multi-tenant apps; prefer single-tenant for internal solutions with minimal scopes.

Entra ID (PowerShell)

# Example: Force admin consent workflow & block user consent for risky scopes
Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions @{
  PermissionGrantPoliciesAssigned = @("ManagePermissionGrantsForSelf.microsoft-user-default-low")
}
# Then create a custom permission grant policy for verified publishers only (portal or Graph API)

Step 3 — Quarantine Tokens & Re-Consent Safely

Revoke refresh tokens for suspicious apps and impacted users.
Block sign-in for the service principal while reviewing logs.
Re-consent only to apps with verified publishers and least privilege.

PowerShell Snippets

# Revoke user refresh tokens
Get-MgUser -All | ForEach-Object { Revoke-MgUserSignInSession -UserId $_.Id }  # scope to impacted users in practice

# Disable a suspicious service principal
Update-MgServicePrincipal -ServicePrincipalId <spId> -AccountEnabled:$false

# Remove an OAuth grant
Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId <grantId>

Note: In production, target specific users/SPNs based on audit evidence.

Step 4 — Monitor Copilot Studio Connectors & Data Paths

Enumerate Power Platform environments, custom connectors, and Copilot Studio bot connections to M365/Graph.
Alert on new connector creations with sensitive scopes; require peer review & change tickets.
Log action invocations (Graph calls) by bots and map to service principals.

Power Platform Admin (PowerShell)

# Power Platform Admin connector sample inventory
Install-Module -Name Microsoft.PowerApps.Administration.PowerShell -Force
Add-PowerAppsAccount
Get-AdminPowerAppConnection | Select-Object EnvironmentName, ConnectorName, CreatedTime, CreatedBy |
  Sort-Object CreatedTime -Descending | Select-Object -First 50

Step 5 — Build Detections (KQL) & Runbooks

Wire these analytic rules in Microsoft Sentinel (or your SIEM) to catch OAuth abuse early.

A) New High-Risk Consent Granted

AuditLogs
| where OperationName in ("Consent to application","Add OAuth2PermissionGrant")
| extend Scopes = tostring(TargetResources[0].modifiedProperties[?].newValue)
| where Scopes has_any ("Mail.ReadWrite","Files.ReadWrite.All","offline_access","Chat.Read","ChannelMessage.Read.All","User.Read.All")
| summarize count() by AppDisplayName=tostring(TargetResources[0].displayName), InitiatedBy=tostring(InitiatedBy.user.userPrincipalName), bin(TimeGenerated, 1h)

B) Spike in Graph Calls from a New Service Principal

AzureDiagnostics
| where Category == "SignInLogs" or Category == "AuditLogs"
| where tostring(ServicePrincipalId) != "" and ResultType == 0
| summarize calls=count() by ServicePrincipalId, AppDisplayName, bin(TimeGenerated, 15m)
| join kind=leftanti (
  AzureDiagnostics
  | where Category == "SignInLogs" or Category == "AuditLogs"
  | summarize baseline=count() by ServicePrincipalId, bin(TimeGenerated, 7d)
) on ServicePrincipalId
| where calls > 100

C) Impossible Travel for SP + “offline_access”

SigninLogs
| where ServicePrincipalId != "" and ConditionalAccessStatus == "notApplied"
| summarize firstCity=arg_min(TimeGenerated, LocationDetails.city), lastCity=arg_max(TimeGenerated, LocationDetails.city) by ServicePrincipalId
| where firstCity != lastCity

Runbook Snippet: On alert → disable SP, revoke affected users’ refresh tokens, export last 7 days of Graph activity, require fresh admin consent with least privilege.

Need Hands-On Help? CyberDudeBivash Can Lock Your OAuth Layer

Tenant-wide OAuth inventory & scope reduction
Consent policy hardening & publisher verification rollout
Copilot Studio & Power Platform data path reviews
Sentinel detections + SOAR auto-quarantine

Explore Apps & Services | cyberdudebivash.com · cyberbivash.blogspot.com · cyberdudebivash-news.blogspot.com

FAQ

Does blocking user consent break Copilot Studio?

No—route consent via an admin workflow and enforce verified publishers. Builders can still deploy; they just can’t grant risky scopes alone.

Are refresh tokens the main risk?

Yes. With offline_access, attackers can maintain long-lived access. Revoke tokens and re-consent with minimal scopes.

What’s the fastest first step?

Inventory apps and disable self-service consent. Then quarantine suspicious SPNs and monitor Graph usage spikes.

CyberDudeBivash — Global Cybersecurity Brand · cyberdudebivash.com · cyberbivash.blogspot.com · cyberdudebivash-news.blogspot.com

#CyberDudeBivash #M365 #OAuth #CopilotStudio #Graph #EntraID #Sentinel #SOAR

Cyberdudebivash