Could a connected application retain access after a password reset?¶

Yes. A connected application may retain cloud access after the account password is reset.

Evidential caution: that changing the password invalidates every application and token.

What this means¶

Applications may use delegated permissions, refresh tokens, API keys, application passwords or service-account credentials.

Their access may continue until the permission, token or credential is revoked separately.

Continued access may explain why files, messages or account settings changed despite the user believing the account had been secured.

Where compromise is suspected, preserve the application-consent, token and audit records before revocation where possible.

Review whether the application created rules, downloaded data, changed permissions or accessed several accounts.

Where the application has broad permissions, assess its potential access even if the logs show limited use. The permission scope may identify data or actions that require further checking.

Applications may also operate across several accounts through administrator consent. Check whether the permission was granted to one user or to the wider tenant before assessing the full potential investigative scope potentially involved.

What to check or do next¶

• Investigators should identify the application name, client ID, publisher, permissions, consent time, token activity and account or administrator that approved it.
• Check whether the application is organisation-managed, user-approved or unknown.
• Do not rely only on the display name. The underlying application or client ID is more reliable.
• Compare application activity before and after the password reset.