What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Contain a suspected malicious Microsoft 365 app at both levels: disable the enterprise application to stop it obtaining new tokens, then revoke sign-in sessions for every affected user. Also investigate the app’s permissions and activity, and check for suspicious authentication methods or other grants. These actions address different parts of the incident; neither guarantees that every already-open app session ends immediately.
1. Identify the app and determine who may be affected
In the Microsoft Entra admin center, inspect the affected user’s application assignments and consented apps. Identify the suspicious enterprise application and record its display name, identifiers, publisher, permissions, consent details, affected users, and event times. Preserve relevant evidence according to your incident-response process before changing the app’s state.
As an Amazon Associate I earn from qualifying purchases.
Search available audit records for the affected users, the period the app had access, and the permissions involved. Microsoft’s app consent grant investigation guidance notes that the audit data needed for this investigation may not be available if auditing was not enabled before the suspected attack. Microsoft’s illicit consent guidance also identifies mailbox auditing and admin or user activity auditing as relevant; searchable retention depends on the subscription.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsAn empty search is not proof that the app was harmless or unused if the required logging was not enabled or the records are no longer retained. Use the evidence you do have to establish the scope, and document what cannot be confirmed.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
2. Disable the malicious enterprise application
Once you have identified the app as malicious, disable it in Microsoft Entra. Microsoft recommends disabling rather than relying on deletion as the initial containment action: a deleted app may reappear if another user later grants consent. Microsoft says a disabled app cannot obtain new tokens to access data, and other users cannot sign in to it or grant it consent. Follow Microsoft’s Disable an application procedure in the Entra admin center.
This is app-level containment. Microsoft’s compromised and malicious applications playbook likewise describes disabling sign-ins to the identified app as a typical containment strategy while responders assess impact and consider further actions, such as deletion or key rotation.
3. Revoke sessions for every affected user
Revoke sessions separately for each affected user, using the Microsoft Entra admin center’s Revoke sessions action or Microsoft Graph. Microsoft’s compromised-account response guidance gives this Microsoft Graph PowerShell example:
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Connect-MgGraph -Scopes User.RevokeSessions.All
Revoke-MgUserSignInSession -UserId <UPN>Replace <UPN> with the affected user’s account. The example uses the User.RevokeSessions.All scope. See Microsoft’s compromised email account response guidance for the response context and the Microsoft Graph revokeSignInSessions documentation for the operation’s behavior.
The Graph operation invalidates the user’s refresh tokens and browser session cookies by resetting signInSessionsValidFromDateTime. Applications then need to obtain a new refresh token through sign-in. It does not revoke sign-in sessions for external users, who authenticate through their home tenant; coordinate with that organization where necessary.
4. Check for account persistence
After containing the app and revoking affected users’ sessions, review the account-level settings that could let an attacker retain or regain access:
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Inspect registered MFA devices and remove suspicious devices or unrecognized authentication methods.
- Review user-consented applications and remove or revoke grants that should not remain.
- Investigate whether other credentials or access paths need response under your organization’s incident process.
Microsoft includes MFA-method and user-consented-app reviews in its compromised email account response guidance.
5. Know what revocation does—and does not—end
| Action | What it addresses | Important limit |
|---|---|---|
| Disable the enterprise app | Prevents that app from obtaining new tokens and prevents further tenant sign-ins or consent to it. | Does not itself revoke every affected user’s session or remove separate account persistence. |
| Revoke a user’s sessions | Invalidates the user’s refresh tokens and browser session cookies so applications must obtain a new refresh token through sign-in. | Does not directly revoke a session token issued and controlled by a downstream application; it also does not revoke external users’ home-tenant sessions. |
| Revoke an application-owned session | Ends a session managed by the app itself, when the app provides a way to do so. | Microsoft Entra cannot directly revoke a session token issued by an application. |
| Delete the enterprise app | Removes the app object. | Microsoft warns that deletion alone may allow the app to return after another user grants consent, so disable it first for containment. |
Microsoft explains in its emergency access guidance that a user can have both an Entra session token and a separate session token issued by an application. The application controls its own session and may not send the user back to Entra until that session expires or the application revokes it. Contact the application provider or use its administrative controls to terminate those sessions where possible.
Microsoft says Entra access tokens are typically valid for one hour. A revoked refresh token cannot be used to renew access, but an already-issued access token may continue working until it expires unless the service evaluates revocation sooner. Continuous Access Evaluation can improve invalidation timing in supported scenarios; it should not be assumed to cover every application or session. The one-hour duration is typical platform behavior, not a guarantee for every token.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
6. Reduce the risk of another consent attack
Review organization-wide user-consent settings in the Entra enterprise-app consent and permissions controls. Microsoft recommends allowing user consent only for applications from verified publishers. Its malicious applications guidance also describes admin consent workflows and risk-based step-up consent, which can route risky requests for administrator review when user consent is enabled. See Microsoft’s user consent configuration guidance for the controls.
If your licensing permits, Microsoft identifies Defender for Cloud Apps OAuth application auditing and the Azure Monitor Workbooks Consent Insights workbook as optional ways to monitor consent-related activity. These monitoring capabilities are not required to disable an app or revoke user sessions.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
