Skip to content
AI Security

Interview question · Identity, OAuth & Access Control

What is OAuth consent phishing, and how do you detect and prevent it?

The attacker never needs the password: the victim grants their app access. The scored answer explains why MFA does not help, then controls consent at the tenant and watches the grants.

mediumNewPreparation tags: Microsoft, Google, CrowdStrikeUpdated Nov 2026

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

Employees receive emails asking them to grant a 'document viewer' app access to their mailbox and files through the real Microsoft sign-in page.

  1. How does consent phishing work?
  2. Why does a password reset not help?
  3. How do you prevent it?
  4. How do you detect it?
  5. What if some employees already consented?
  6. How would you respond and prevent recurrence?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Premium opens every answer and ladder.

UP NEXT ON YOUR JOURNEY
Next in this trackWhen should an agent's action require step-up authentication, and how do you implement it?Next in this trackHow would you detect stolen session cookies or refresh tokens being used?Next in this trackWhen is an API key acceptable, and when do you need OAuth?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.