Tagged #token-revocation

Microsoft 365 OAuth Consent Defense

Containing an OAuth consent compromise, the four moves you have to make in order

Revoke grants. Disable the SP. Revoke refresh tokens. Tenant-block the AppId. Order matters and most SOCs do it …