Before
An analyst inspected recent consent activity and checked each application or client ID against the approved list. Findings then had to be summarized, communicated to the security team, and entered into a security incident, while no-finding periods still required manual review.
How it works
- Retrieve the approved application list and recent application-consent events for the configured 15-minute window.
- Compare each observed application name and OAuth client ID with the approved values and determine whether exceptions exist.
- If exceptions are found, send one consolidated team notification and create one security incident; otherwise, complete without reporting.
Workflow details
- Trigger and review window: An on-demand asynchronous webhook starts the workflow; the documented operational schedule is every 15 minutes. The flow builds a 15-minute lookback window and retrieves recent application-consent activity.
- Allowlist and evidence: The workflow reads the approved AI application list and collects consent details, including the application name, OAuth client ID, initiating user, and event timestamp.
- Automated decision: Each consent is compared with approved application names and OAuth client IDs. Approved activity is excluded, while unmatched applications are formatted as security findings; if there are no findings, the flow ends with a no-report completion.
- Exception handling: When exceptions exist, the workflow combines them into one summary, posts one notification to the security team in Teams, and creates one security incident with the findings for follow-up.
What changed
The review window and allowlist comparison now happen automatically, and only nonempty exception results enter the notification and incident path. Security receives one consolidated handoff containing the unapproved application, client ID, initiating user, and timestamp details.
Work removed
Reviewing recent consent events one by one, cross-checking application names and client IDs against the approved list, assembling a findings summary, posting the team notification, and creating the security incident.
Expected outcome
At the documented cadence, one automated comparison covers each 15-minute window and produces at most one consolidated alert and one incident per run when exceptions are present.
