Can an application access the cloud account on the user’s behalf?¶
Yes. An application can access a cloud account on the user’s behalf if the service has granted it permission.
This may be legitimate, such as an email client, backup tool, calendar application or document service.
What this means in practice¶
An application may read, create, edit, upload, send or delete data automatically. It may continue operating in the background after the user closes the main cloud service.
Access is often granted through an authorisation process using tokens. The application may receive specific permissions, such as reading files or sending messages, without learning the user’s password.
In an investigation, identify which application had access, who granted it, what permissions were approved and what actions were linked to it.
Where compromise is suspected, application access may survive a password reset. The permission or tokens may need separate revocation.
What this may show¶
This can create valuable evidence. Provider logs may record the application identifier, permissions, consent time, token issue, IP address and later activity.
What this does not show on its own¶
The dangerous assumption is that every cloud action recorded against the user’s account was performed manually by that user.
But the application name shown to the user may not uniquely identify the software or operator. Malicious applications can use misleading names, and legitimate applications can be compromised.
What to do next¶
Check whether the application was installed on a device, connected through a browser or operated entirely as an online service. Also consider whether several accounts used the same application.
Do not assume that application activity proves the account holder intended each action. The software may act automatically, under another user’s control or outside the user’s awareness.
Key takeaway
Application access can create genuine account activity without direct user action, so identify the application, permissions and automation before attributing the event to a person.