ChatGPT in your inbox? Investigating Entra apps that request unexpected permissions
ID: 903f78aa-89ef-575a-ba86-1150a8bde964
STIX ID: report--903f78aa-89ef-575a-ba86-1150a8bde964
Feed Name: Red Canary
Azure AD audit logs record that a new 'ChatGPT' service principal (AppId e0476654-c1d5-430b-ab80-70cbd947616a) was added to tenant 747930ee-9a33-43c0-9d5d-470b3fb855e7 and user-level consent was granted for Mail.Read, offline_access, profile, and openid scopes, initiated by Azure ESTS Service for [email protected]. This appears to be routine application registration and OAuth consent activity rather than a security incident, though it should be validated if the action was not expected.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.