🛡️ Recipe · Security & Compliance

Review Consent Phishing Protection and Attack Simulation Policies in Microsoft 365

Audit user consent settings and phishing simulation campaigns across Entra ID and Microsoft Defender

Complexity

Intermediate

Impact

security + compliance + identity + phishing-defense + audit

Context

Why This Matters

Consent phishing (also called illicit consent grant attacks) is a rapidly growing threat where attackers trick users into granting OAuth permissions to malicious applications — bypassing MFA entirely. Microsoft 365 provides two complementary defenses:

User consent settings in Entra ID, which restrict when and how end users can grant permissions to third-party apps.
Attack Simulation Training in Microsoft Defender for Office 365, which runs benign phishing campaigns against your users to measure and improve resilience.

This recipe walks you through auditing both configurations so you know exactly where they live, what state they are in, and whether your tenant is adequately protected.

Run this recipe during any of the following:

Quarterly security posture reviews
Incident response after a suspected consent phishing event
Onboarding a new tenant or Defender P2 license
Compliance audits (ISO 27001, SOC 2, NIST CSF)

Expected Outcomes

After completing this recipe you will have:

Documented the current authorizationPolicy and permission grant policy assignments for your tenant.
Confirmed whether the admin consent workflow is enabled.
A list of active, scheduled, and historical attack simulations (or confirmation that none exist).
A clear understanding of where each setting is managed in the Entra admin center and the Microsoft Defender portal.
Actionable recommendations for tightening consent controls and scheduling baseline phishing simulations.

Risks & Considerations

Things to watch out for

Do not tighten consent settings without communication. Moving from Allow user consent for verified publishers to Do not allow user consent can break legitimate apps that users have self-service onboarded (e.g., Zoom, Slack, Grammarly). Always enable the admin consent workflow first so users have a path to request access.
Attack Simulation Training requires Microsoft Defender for Office 365 Plan 2 (included in M365 E5). If the Defender portal does not show the feature, verify licensing before assuming nothing is configured.
Running a simulation without coordinating with HR and the help desk can trigger a flood of phishing reports and user anxiety. Always communicate the program (not the timing) in advance.
The AttackSim.Read.All permission is required to enumerate simulations via Graph. A 204 response may mean either "no simulations exist" or insufficient permissions — verify both.
Changes to the authorization policy apply tenant-wide and take effect within minutes. Test in a pilot group where possible using custom permission grant policies.

Required Permissions

Permission	Why It's Needed
Policy.Read.All	Read the tenant authorizationPolicy and permission grant policy assignments.
Policy.ReadWrite.Authorization	Required if you plan to modify user consent settings after the review.
AttackSimulation.Read.All	Enumerate attack simulation campaigns and their status via the Security API.
Directory.Read.All	Resolve tenant-level identity context when inspecting consent policies.

The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.

For IT Admins

Paste into Dex Pro

Audit our Microsoft 365 tenant for consent phishing protection and attack simulation coverage. Report the current user consent setting in Entra ID, which permission grant policies are assigned, whether the admin consent workflow is enabled, and list any active or scheduled Attack Simulation Training campaigns. Flag any gaps and recommend remediation.

Try in Dex Pro

Part 1 — Review Consent Phishing Protection (Entra admin center)

Sign in to the Microsoft Entra admin center at https://entra.microsoft.com with a Global Administrator or Security Administrator role.
Navigate to:
Identity › Applications › Enterprise applications › Consent and permissions
Open the User consent settings tab and note the current selection:
- Do not allow user consent (most restrictive)
- Allow user consent for apps from verified publishers, for selected permissions (recommended)
- Allow user consent for all apps (least restrictive — not recommended)
Open the Group owner consent settings tab and confirm group-level consent is appropriately scoped.
Open the Admin consent settings tab and verify that Users can request admin consent to apps they are unable to consent to is set to Yes. Confirm that reviewers (a group or specific users) are configured.
Optionally, review assigned permission grant policies at
Identity › Applications › Enterprise applications › Consent and permissions › Permission classifications
to see which delegated permissions are classified as low risk.

Part 2 — Review Attack Simulation Policies (Microsoft Defender portal)

Sign in to the Microsoft Defender portal at https://security.microsoft.com.
In the left navigation, go to:
Email & collaboration › Attack simulation training
Review each tab:
- Overview — summary dashboard of recent activity and repeat offenders.
- Simulations — list of all simulations (Draft, In progress, Scheduled, Completed, Cancelled).
- Simulation automations — recurring automated campaigns.
- Payload automations — automated payload harvesting.
- Training — assigned training modules and completion rates.
- Settings — end-user notifications, simulation users excluded, and repeat offender thresholds.
Record the count of active simulations and note any that are in a Failed or Cancelled state.
If no simulations exist and the feature is licensed, consider scheduling a baseline Credential Harvest simulation targeting a small pilot group.

Check user consent / authorization policy

Retrieves the tenant-wide authorization policy which governs default user consent behavior.

GET https://graph.microsoft.com/v1.0/policies/authorizationPolicy

Sample response (truncated):

{
  "id": "authorizationPolicy",
  "allowInvitesFrom": "everyone",
  "defaultUserRolePermissions": {
    "permissionGrantPoliciesAssigned": [
      "ManagePermissionGrantsForSelf.microsoft-user-default-recommended",
      "ManagePermissionGrantsForSelf.microsoft-user-default-allow-consent-apps"
    ]
  }
}

Interpret the permissionGrantPoliciesAssigned array:

microsoft-user-default-low — strictest, low-risk permissions only
microsoft-user-default-recommended — Microsoft-recommended baseline (verified publishers)
microsoft-user-default-legacy — legacy behavior, permissive
Empty array — user consent is disabled

Inspect a specific permission grant policy

GET https://graph.microsoft.com/v1.0/policies/permissionGrantPolicies/microsoft-user-default-recommended

List attack simulations

GET https://graph.microsoft.com/beta/security/attackSimulation/simulations

Response codes:

200 OK with a value array — simulations exist; inspect status, launchDateTime, and completionDateTime for each.
204 No Content — no simulations configured in the tenant.
403 Forbidden — missing AttackSimulation.Read.All scope.

List simulation automations

GET https://graph.microsoft.com/beta/security/attackSimulation/simulationAutomations

Retrieve per-user simulation results

GET https://graph.microsoft.com/beta/security/attackSimulation/simulations/{id}/report/simulationUsers

Automated audit with Microsoft Graph PowerShell

The script below connects to Microsoft Graph with the minimum required read scopes, then produces a consolidated report covering user consent posture and attack simulation inventory. It is safe to run in any tenant — it performs no writes.

Prerequisites

PowerShell 7+ (or Windows PowerShell 5.1 with the Microsoft.Graph module)
Install-Module Microsoft.Graph -Scope CurrentUser
An account with at minimum Security Reader role

What the script does

Connects to Graph with Policy.Read.All and AttackSimulation.Read.All scopes.
Reads the tenant authorizationPolicy and decodes the assigned permission grant policies into plain English.
Lists all attack simulations and automations, flagging whether any are currently active.
Outputs a color-coded summary to the console and optionally exports a CSV.

Usage

# Basic run — summary to console
.\Review-ConsentAndAttackSim.ps1

# Export to CSV
.\Review-ConsentAndAttackSim.ps1 -ExportPath "C:\Reports\consent-audit.csv"

Next steps

More Security & Compliance recipes

Browse the rest of this category in the Dex Cookbook.

Automate this with Dex Pro

Let the autonomous IT engineer run this task under your policies.

Start free

Point Dex at a tenant and try it for 30 days, no credit card.