Detecting Malicious Entra OAuth Apps with LLM-Based Permission Risk Scoring

TL;DR

This paper tackles the risk of malicious OAuth consent and app registrations in Microsoft Entra ID by proposing a permission-centric detection framework. It builds a comprehensive corpus of Microsoft Graph permissions and assigns LLM-generated risk scores to each permission, enabling deterministic aggregation into per-app risk; these scores feed a real-time detection pipeline with explainable rationale traces. The authors release a public dataset covering 769 permissions across eight open-source LLMs, plus open-source code for a tenant-oriented detector that emits alerts and stores state for longitudinal analysis. The framework supports continuous monitoring of OAuth grants and app roles, leveraging floors, caps, synergy, and spike logic to detect abrupt privilege escalations. The work demonstrates that a permission-first approach can meaningfully identify over-privileged or rogue apps in Entra ID without requiring complete app descriptions, with practical implications for enterprise cloud security.

Abstract

This project presents a unified detection framework that constructs a complete corpus of Microsoft Graph permissions, generates consistent LLM-based risk scores, and integrates them into a real-time detection engine to identify malicious OAuth consent activity.

Figures (21)

• Figure 1: OAuth Protocol Flow
• Figure 2: OAuth2 Authorization Code Flow with Refresh Token (Microsoft Identity Platform OwenRichards1
• Figure 3: Rogue Application Detection Framework
• Figure 4: Detection Pipeline Overview
• Figure 5: Standard Deviation of Scores