Rare OAuth Consent with Sensitive Delegated Permissions

let target_user = "denis@example.com";
AuditLogs
| where TimeGenerated >= ago(7d)
| where LoggedByService =~ "Core Directory"
| where Category =~ "ApplicationManagement"
| where OperationName =~ "Consent to application"
| where Result =~ "success"
| extend
    InitiatingUser = tolower(tostring(InitiatedBy.user.userPrincipalName)),
    InitiatingIP = tostring(InitiatedBy.user.ipAddress)
| where InitiatingUser == tolower(target_user)
| mv-apply TargetResource = TargetResources on (
    where TargetResource.type =~ "ServicePrincipal"
    | extend
        AppDisplayName = tostring(TargetResource.displayName),
        ServicePrincipalId = tostring(TargetResource.id),
        ModifiedProperties = TargetResource.modifiedProperties
)
| mv-apply Property = ModifiedProperties on (
    where Property.displayName =~ "ConsentAction.Permissions"
    | extend ConsentFull = trim(@'"', tostring(Property.newValue))
)
| parse ConsentFull with * "ConsentType: " ConsentType ", Scope: " GrantScope "]" *
| project
    TimeGenerated,
    InitiatingUser,
    InitiatingIP,
    AppDisplayName,
    ServicePrincipalId,
    ConsentType,
    GrantScope,
    CorrelationId
| order by TimeGenerated asc

index=<entra_audit_index> sourcetype=<entra_audit_sourcetype>
earliest=-7d
(OperationName="Consent to application" OR ActivityDisplayName="Consent to application")
| eval
    user=lower(coalesce(user, userPrincipalName, InitiatedByUserPrincipalName)),
    src=coalesce(src, ipAddress, InitiatingIpAddress),
    app_name=coalesce(app_name, TargetResourceDisplayName, AppDisplayName),
    service_principal_id=coalesce(service_principal_id, TargetResourceId, ServicePrincipalId),
    permissions=coalesce(permissions, ConsentActionPermissions, GrantScope),
    consent_type=coalesce(consent_type, ConsentType),
    correlation_id=coalesce(correlation_id, CorrelationId),
    result=lower(coalesce(result, Result))
| where user="denis@example.com" AND result="success"
| fields _time user src app_name service_principal_id permissions consent_type correlation_id
| sort 0 _time

let candidate_service_principal = "<service_principal_id>";
AuditLogs
| where TimeGenerated >= ago(30d)
| where OperationName =~ "Consent to application"
| where Result =~ "success"
| extend
    InitiatingUser=tolower(tostring(InitiatedBy.user.userPrincipalName)),
    InitiatingIP=tostring(InitiatedBy.user.ipAddress)
| mv-apply TargetResource=TargetResources on (
    where TargetResource.type =~ "ServicePrincipal"
    | extend
        AppDisplayName=tostring(TargetResource.displayName),
        ServicePrincipalId=tostring(TargetResource.id)
)
| where ServicePrincipalId == candidate_service_principal
| summarize
    FirstSeen=min(TimeGenerated),
    LastSeen=max(TimeGenerated),
    ConsentEvents=count(),
    Users=make_set(InitiatingUser, 500),
    SourceIPs=make_set(InitiatingIP, 100)
    by AppDisplayName, ServicePrincipalId
| extend UniqueUsers=array_length(Users)
| order by UniqueUsers desc

index=<entra_audit_index> sourcetype=<entra_audit_sourcetype>
earliest=-30d
(OperationName="Consent to application" OR ActivityDisplayName="Consent to application")
| eval
    user=lower(coalesce(user, userPrincipalName, InitiatedByUserPrincipalName)),
    src=coalesce(src, ipAddress, InitiatingIpAddress),
    app_name=coalesce(app_name, TargetResourceDisplayName, AppDisplayName),
    service_principal_id=coalesce(service_principal_id, TargetResourceId, ServicePrincipalId)
| where service_principal_id="<service_principal_id>"
| stats
    min(_time) as first_seen
    max(_time) as last_seen
    count as consent_events
    dc(user) as unique_users
    values(user) as users
    values(src) as source_ips
    by app_name service_principal_id
| convert ctime(first_seen) ctime(last_seen)
| sort - unique_users

let candidate_service_principal = "<service_principal_id>";
AuditLogs
| where TimeGenerated >= ago(7d)
| where LoggedByService =~ "Core Directory"
| where Category =~ "ApplicationManagement"
| where OperationName in~ (
    "Add delegated permission grant",
    "Add app role assignment to the service principal"
)
| where Result =~ "success"
| where tostring(TargetResources) has candidate_service_principal
| extend
    InitiatingUser=tolower(tostring(InitiatedBy.user.userPrincipalName)),
    InitiatingApp=tostring(InitiatedBy.app.displayName),
    InitiatingIP=tostring(InitiatedBy.user.ipAddress)
| project TimeGenerated, OperationName, InitiatingUser, InitiatingApp, InitiatingIP, TargetResources, AdditionalDetails, CorrelationId
| order by TimeGenerated asc

index=<entra_audit_index> sourcetype=<entra_audit_sourcetype>
earliest=-7d
(OperationName="Add delegated permission grant"
 OR OperationName="Add app role assignment to the service principal"
 OR ActivityDisplayName="Add delegated permission grant"
 OR ActivityDisplayName="Add app role assignment to the service principal")
| eval
    user=lower(coalesce(user, userPrincipalName, InitiatedByUserPrincipalName)),
    src=coalesce(src, ipAddress, InitiatingIpAddress),
    operation=coalesce(OperationName, ActivityDisplayName),
    service_principal_id=coalesce(service_principal_id, TargetResourceId, ServicePrincipalId),
    correlation_id=coalesce(correlation_id, CorrelationId)
| where service_principal_id="<service_principal_id>"
| table _time user src operation app_name service_principal_id permissions correlation_id
| sort 0 _time

let target_user = "denis@example.com";
let target_app = "Share-File Point Document";
SigninLogs
| where TimeGenerated >= ago(7d)
| where UserPrincipalName =~ target_user
| where AppDisplayName =~ target_app
| project
    TimeGenerated,
    UserPrincipalName,
    AppDisplayName,
    AppId,
    IPAddress,
    ResourceDisplayName,
    ResultType,
    ConditionalAccessStatus,
    AuthenticationRequirement,
    CorrelationId
| order by TimeGenerated asc

index=<identity_index> sourcetype=<entra_user_signin_sourcetype>
earliest=-7d
| eval
    user=lower(coalesce(user, UserPrincipalName, user_principal_name)),
    app_name=coalesce(app_name, AppDisplayName),
    app_id=coalesce(app_id, AppId),
    src=coalesce(src, IPAddress, ip_address),
    resource=coalesce(resource, ResourceDisplayName),
    result=coalesce(result, ResultType),
    conditional_access=coalesce(conditional_access, ConditionalAccessStatus),
    auth_requirement=coalesce(auth_requirement, AuthenticationRequirement),
    correlation_id=coalesce(correlation_id, CorrelationId)
| where user="denis@example.com" AND app_name="Share-File Point Document"
| fields _time user app_name app_id src resource result conditional_access auth_requirement correlation_id
| sort 0 _time