OAuth apps are the new admin accounts
Aug 27th, 2025 by Jesper Kråkhede
This month an attacker stole OAuth tokens from a chat integration used by a sales automation platform. With those tokens, the attacker could read data from the customers´ CRM systems directly, without logging in, without passwords and without MFA. Researchers have mentioned more than 700 potentially affected organisations. The attacker searched the data for credentials, keys and tokens that could open even more doors.
The CRM platform itself wasn´t vulnerable. The integration was.
This is a pattern I expect to see a lot more of. Every time you connect an app to your Microsoft 365, CRM or other SaaS service, you give it a token with permissions. Many of those tokens are long lived, have broad access and are rarely reviewed. They are, in practice, admin accounts that nobody manages.
What should you do? Make an inventory of all connected apps and their permissions. In Entra, look at enterprise applications and consents. In other SaaS platforms, look at connected apps. Remove the ones that are no longer used. Review the permissions of the rest and reduce them. Restrict who can consent to new apps, so users can´t give an app access to the whole organisation with one click. Use app governance in Defender for Cloud Apps to detect apps that behave unusually, like downloading large amounts of data. And make sure tokens expire and can be revoked quickly.
Don´t store secrets in your CRM either. The attacker went looking for them.
Every integration is a key to your house. Know who holds them.