The OAuth apps nobody remembers approving
Consent phishing skips the password entirely — the user hands a third-party app the keys themselves. A quarterly grant audit is the fix, and it takes an afternoon.
Ask your team how many third-party apps have access to your company email and files. Most people guess three or four. The real number, in a typical workspace, is dozens — and nobody can name what half of them do.
Why this is the quiet problem
Consent phishing doesn't steal a password. It shows a real login page, asks the user to approve a real app, and the user grants it mail.read and files.read.all themselves. No malware, no suspicious login, nothing for your email filter to catch. The app keeps its access after password changes, after MFA resets, sometimes after the employee leaves.
The afternoon audit
- Export every OAuth grant in your identity provider and workspace admin console. Both Google Workspace and Microsoft 365 list them.
- Sort by scope. Anything holding broad mail, file or directory access goes to the top of the pile. A calendar widget does not need to read every file.
- Revoke what nobody can explain. If no owner steps forward within a week, the grant goes. Someone will complain if it mattered — that complaint is the documentation.
- Require admin approval for new grants. Both major suites can restrict user consent to a vetted allowlist. Turn it on.
- Repeat quarterly. Grants accumulate like browser tabs.
The reason this stays undone is that it's boring and manual. It's also exactly the kind of inventory BlackPing keeps continuously — new grant with broad scopes shows up as a signal the moment it happens, not at the next quarterly review.