Detecting quiet persistence in Entra ID app registrations
SBS Cloud Security5 August 202611 min read
Endpoint persistence is loud. App-registration persistence is not. A rogue application with a well-chosen API permission survives password resets, device wipes and reboots — and most teams never think to look for it. This is how we hunt it down.
Why app registrations are attractive
An app registration with a client secret and the right Microsoft Graph permission can read mail, reset passwords or exfiltrate data without ever touching a user session.
Because the access is tied to the application rather than a person, it is invisible to controls that watch user sign-ins.
Hunting the rogue app
Start with recently created applications and newly added credentials — especially secrets with unusually long lifetimes.
Cross-reference high-privilege Graph permissions (Mail.ReadWrite, Directory.ReadWrite.All) granted through admin consent against your change-management records.
Hardening
Restrict who can register applications and who can consent to permissions.
Alert on new app credentials and on any admin-consent grant for high-privilege scopes.
Key takeaways
- App-registration persistence survives password resets and device wipes — hunt for it explicitly.
- Watch for new credentials and high-privilege Graph consent grants.
- Lock down who can register apps and who can grant consent.