What is an application-consent foothold?¶
An application-consent foothold is continuing access obtained through permissions granted to an application.
Avoid the dangerous assumption¶
The dangerous assumption is that revoking a user password always removes application access.
It may not.
A user or administrator may have granted an application permission to access email, files, profile data, APIs or organisational resources.
The application may then operate without an ordinary interactive login each time.
Investigators should preserve:
- the application identifier
- tenant or publisher information
- permissions requested and granted
- consenting account
- consent time
- administrator approval
- credentials or certificates used
- API activity
- revocation actions
- linked accounts and sessions.
Do not rely on the application display name. Stable identifiers matter.
The presence of consent does not prove the application used every permission.
API and audit records are needed to show actual activity.
Likewise, the user may have approved the application through deception rather than knowingly supporting malicious access.
Provider-specific permission and revocation behaviour can change and should be verified.
Application access may survive password reset and may affect several users or resources depending on the permission scope.
Consent may be granted by an ordinary user, administrator or automated deployment process. The scope of that consent determines whether access was limited to one account, a group of users or wider organisational data.
Review later application activity to establish which permissions were actually exercised and which remained unused.
That usage evidence should guide both containment and reporting.
Operational takeaway¶
Preserve the application, permission, consent and API records, and verify whether access continued independently of the user’s password.