Developers continuously create new third-party enterprise applications that connect directly to Microsoft 365 (M365) tenants. These applications access organizational data to streamline business processes and improve collaboration. While they offer many benefits, they also introduce complexity to your network and expand your organization's attack surface.
Customer relationship management (CRM) tools, single sign-on (SSO) services and enterprise resource planning (ERP) systems are common examples of third-party applications. These applications often require extensive permissions, and if misconfigured or maliciously designed, they can pose serious risks to your organization.
Our data from January to November 2024 reveals a concerning trend: newly connected third-party applications generated 55,096 alerts across our customer base. These alerts included those classified as valid, approved, false positives, or required further investigation.
Shown below, you see an example of an M365 alert showing a new third-party application connection. This type of alert helps identify who connected the app and its name - key information for maintaining security.
This surge in alerts highlights the need for organizations to pay closer attention to third-party applications connecting to their M365 environments. Without proper monitoring and control, these connections can lead to security risks such as data exfiltration and privilege escalation.
Data Exfiltration
What is data exfiltration? It’s when an adversary tries to steal data, typically falling in the latter stages of a cyber attack.
Improperly monitored applications can become an easy pathway for data exfiltration. For instance, if you grant a third-party app excessive permissions, malicious actors can exploit it to access sensitive data and move it out of your environment undetected. If data is leaving your network, it means you’ve had an intrusion and indicates that earlier protective measures before exfiltration failed to detect or prevent stolen data.
Privilege Escalation
Once you’ve connected a third-party application to a Microsoft 365 tenant, its privileges can vary widely. Some third-party applications may only access basic profile information, while others may gain access to entire data stores.
Malicious actors can use these privileges to escalate access within your environment. For example, by leveraging a connected application’s tokens, they could authenticate as users and gain access to email communications or sensitive documents—even with MFA enabled.
Below is a screenshot showing extensive permissions requested by a third-party application. While not inherently malicious, apps requesting broad access should be carefully reviewed and monitored.
The consequences of privilege escalation are particularly severe for critical infrastructure sectors such as energy, transportation and financial services. A compromised privileged account could lead to:
Managing third-party applications to effectively secure your Microsoft 365 environment is critical. Here are three best practices to reduce risks and maintain control over sensitive organizational data:
Implementing these practices can help organizations mitigate the risks associated with third-party applications and maintain a secure, efficient Microsoft 365 environment. Regular monitoring, auditing and pruning of applications are foundational steps toward a robust cybersecurity strategy.
Blumira is purpose-built to strengthen the security of your Microsoft 365 environment by providing pre-tuned detections, real-time alerts and actionable insights. With seamless integration and a user-friendly platform, Blumira empowers organizations to:
Our seamless integration with Microsoft 365 provides critical detections that are not readily available through default tools, such as suspicious application behaviors or unauthorized configurations that could compromise security. With features tailored for small to midsize businesses, Blumira helps organizations minimize their attack surface and stay one step ahead of evolving threats.
The Girl Scouts of Southeastern Michigan (GSSEM) demonstrate Blumira's role in strengthening the security of Microsoft 365 environments. With a small IT team responsible for safeguarding sensitive data across the entire organization, GSSEM faced the challenges of limited resources and increasing cyber threats. By deploying Blumira, the organization gained critical insights into its Microsoft 365 environment, allowing it to detect and respond to potential security issues efficiently.
Blumira's real-time alerts helped GSSEM uncover and mitigate suspicious activity, such as risky third-party application connections. This proactive approach enhanced the security of their data and freed up valuable time for their IT staff, empowering them to focus on other priorities. The result was a more secure and resilient digital workspace, demonstrating Blumira's value in protecting organizations of all sizes.
Third-party applications can deliver significant business value but also introduce security risks that organizations cannot afford to ignore. By proactively managing permissions, auditing connections and removing unnecessary apps, you can protect your Microsoft 365 environment from potential threats.
Ready to enhance the security of your Microsoft 365 environment? Blumira’s threat detection and response platform helps you monitor third-party application connections, identify risks and respond quickly to potential threats—without needing an entire in-house security team.
Contact us or schedule a demo to see Blumira in action!