Identifies an illicit consent grant where a non-admin user consents to an application requesting high-risk delegated mailbox permissions (Mail.Read, Mail.ReadWrite, Mail.Send or MailboxSettings.ReadWrite) together with offline_access. offline_access returns a long-lived refresh token, so a single successful end-user consent gives an attacker-controlled application durable, silent read/send access to the victim mailbox without re-prompting for MFA. This is a common precursor to business email compromise (BEC), mailbox exfiltration and internal phishing. This rule complements "Suspicious application consent for offline access": it drops the known-application allowlist join and instead pins the high-fidelity scope combination, and it additionally covers mailbox write/send scopes (Mail.ReadWrite, Mail.Send, MailboxSettings.ReadWrite), not only read. For AuditLogs schema see https://learn.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities.

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.