What is multi-tenant app consent?
Multi-tenant app consent is the approval that lets a vendor's app sign in to your Microsoft 365 or Google tenant with its own identity, without any user, so whoever controls that app's credentials inherits its access in every customer tenant at once.
Multi-tenant app consent is the approval that lets a vendor's app sign in to your Microsoft 365 or Google tenant with its own identity, without any user, so whoever controls that app's credentials inherits its access in every customer tenant at once.
Why it matters
Backup, security and AI tools often hold broad admin-consented permissions. User MFA does not protect these sign-ins, because no user is involved. AI agents can now try such identities across thousands of tenants in minutes.
Example
On 21 Oct 2026 Microsoft said China-aligned Storm-0940 used ARTEX AI agents and hijacked ConnectWise app identities to sign in to 2,250+ tenants, reaching admin in some within 3 hours (Microsoft).
How to defend against it
- Review admin-consented apps every quarter and remove unused ones.
- Grant each app the least privilege it needs.
- Restrict app-only sign-ins with conditional access for workload identities.
- Alert when an app adds credentials or role assignments.
See the matching controls in the AgentSec Brief checklist.
Related terms
Non-human identity; Token and privilege compromise; Least privilege
Sources
From AgentSec Brief, the daily brief on securing agentic AI. Subscribe free at https://www.agentsecbrief.com