That Old App in Your Microsoft 365 Tenant Might Have the Keys to Everything

Open Entra ID in almost any small business tenant and look at the list of enterprise applications. It's usually a lot longer than anyone expects. A scanning tool from a vendor you dropped years ago. A calendar add-in someone tried for a week. A "test" app an old IT contractor set up and never removed.

Sitting in a list, they all look harmless. The problem is what some of them were allowed to do when they were set up, and the fact that none of it changes when everyone stops using them.

More access than you'd expect

Every time someone connects an outside tool to Microsoft 365, Entra ID creates an enterprise application for it, along with whatever permissions the tool asked for. Some of those permissions let the app work on its own, with nobody signed in, across the whole company. An app like that can read every mailbox, not just one person's. And because no person is signing in, MFA doesn't apply.

A few permissions go even further. Security researchers at SpecterOps have shown that a single one can let an app make any account a Global Administrator. That's full control of your tenant, held by an app nobody remembers configuring.

These permissions usually get granted for a good reason at the time. A migration tool needed them for a weekend. A vendor's setup guide said to grant admin consent, and someone clicked the button. The project ended, and the permissions stayed.

It happened to Microsoft

In January 2024, Microsoft disclosed that Midnight Blizzard, a Russian state-backed group, had gotten into its corporate email. According to Microsoft, the attackers broke into an old test account that didn't have MFA, then found "a legacy test OAuth application that had elevated access to the Microsoft corporate environment." They used it to give themselves access to mailboxes and read corporate email.

An old test app with more access than anyone realized. That's the same pattern we find in small business tenants.

It happens through vendors too

In August 2025, Google's Threat Intelligence Group reported that attackers had stolen access tokens for Salesloft's Drift app, a sales chat tool many companies had connected to Salesforce. They used those tokens to pull data out of numerous companies' Salesforce accounts, and even read email from some Google Workspace accounts connected to the same app.

None of those companies had their own systems broken into. The connected app was the way in.

Resetting passwords won't fix it

Microsoft has also reported attackers creating their own apps inside victims' tenants, so they keep access even after losing the account they first broke into. Some used those apps to run crypto mining, and Microsoft says targeted organizations were left with cloud bills of anywhere from $10,000 to $1.5 million.

A password reset doesn't touch any of that. The app keeps working until someone finds it. It's a close cousin of the problem we covered in our post on forgotten Microsoft 365 accounts. Accounts and apps that nobody owns are the ones nobody watches.

Why cleanup takes a careful hand

This isn't as simple as deleting whatever looks unfamiliar. Some apps with odd names are Microsoft's own and need to stay. Others quietly run your backups or your phone system. Remove the wrong one and something important stops working. Leave the wrong one and the door stays open.

Sorting out which is which, and keeping new apps from piling up again, is the kind of work Cracked Cloud does every day.

Not sure what's connected to your tenant?

If you can't say for certain what every app in your Entra ID is doing, you're not alone, and it's worth finding out before someone else does. Our free Microsoft 365 Security Assessment includes a look at enterprise apps that have high levels of access, along with MFA, admin accounts and the other usual suspects. You'll get a plain-English list of what to fix first, whether you hire us to fix it or not.

Sources

• Microsoft Security Blog, Midnight Blizzard: Guidance for responders on nation-state attack
• Google Threat Intelligence Group, Widespread Data Theft Targets Salesforce Instances via Salesloft Drift
• Microsoft Security Blog, Threat actors misuse OAuth applications to automate financially driven attacks
• SpecterOps BloodHound documentation, AZMGGrantAppRoles