Search papers, labs, and topics across Lattice.
This study systematically examines the Microsoft 365 (M365) app ecosystem, focusing on the security implications of OAuth permissions granted to third-party applications. By crawling over 8,000 applications, the authors identify significant inconsistencies in permission transparency and find that many apps request overly broad access, violating least-privilege principles. The research employs a topic-aware anomaly detection framework to correlate anomalous permission requests with potential security risks, ultimately providing tenant administrators with actionable insights to mitigate these risks.
Over 80% of third-party M365 applications request permissions that could expose organizations to significant security risks, often violating basic principles of least privilege.
The Microsoft 365 (M365) ecosystem hosts thousands of third-party applications that integrate with enterprise tenants via fine-grained OAuth permissions, potentially granting access to sensitive organisational resources such as emails, files, calendars, chats, and user directories. Despite the security implications of these permission grants, the M365 ecosystem has not been systematically studied. We present the first privacy- and security-oriented measurement of M365 third-party applications. By combining public marketplace APIs with automated tenant-side deployment, we crawl over 8,000 applications. We find that only 1,069 of them expose both descriptions and permission sets, with significant inconsistencies in transparency across official distribution channels. Next, we leverage a topic-aware anomaly detection framework to assess whether requested permissions align with declared functionality. We cluster applications via Neural Topic Modelling and apply unsupervised anomaly detection within each topic to identify deviations from peer permission profiles. LLM-assisted analysis of the most anomalous cases and blind manual inspection reveal a correlation between anomalous permission profiles and the risk associated with the requested permissions. We find that many applications request overly broad tenant-wide scopes (e.g., directory-wide read/write access), violating least-privilege principles and increasing the organisational attack surface. Our pipeline provides tenant administrators with actionable insights by identifying anomalous applications and the permissions that most contribute to their anomalousness. Overall, our findings expose systemic opacity and structural immaturity in the M365 app ecosystem, where permission disclosure is inconsistent and over-privileged access is common.
