Skip to main content
MI Support IT logo

IT security

What is OAuth 2.0?

OAuth 2.0 lets apps access your data without knowing your password. See how tokens and consent work, and where the risk hides.

In short

OAuth 2.0 is the open standard that lets an application access a user's data at another service without ever seeing the user's password.

Instead of handing over the password, the user approves the access at the identity provider, after which the application receives a time-limited access token with precisely scoped permissions, called scopes. It is the mechanism behind every 'Give the app access to...' screen and the foundation beneath the integrations in modern cloud environments. Technically, OAuth is authorisation, not sign-in; for identity itself, OpenID Connect is used, which is built on top.

The standard dates from 2012, and its successor OAuth 2.1, which consolidates the tightened security requirements such as mandatory PKCE, is making its way through the IETF. The downside is consent phishing, where attackers lure users into approving malicious apps, which is why app consents must be governed centrally. MI Support IT helps Danish businesses govern and monitor app access in Microsoft 365.

Back to the glossary

What is OAuth 2.0?

OAuth 2.0 is the open standard for delegated access: it lets an application use a scoped subset of your data at another service, without you ever handing your password to the application. The standard was published by the IETF in 2012 as RFC 6749 and is today the foundation beneath virtually every integration between cloud services.

Before OAuth, the alternative was grim: if an accounting application wanted to read your bank data, it needed your online banking credentials. With OAuth, you instead approve the access at the bank, and the application receives a token that can only do what you said yes to.

How does it work?

Four roles interact: the user, the application (the client), the authorisation server (for example Microsoft Entra ID) and the service holding the data. The flow:

  1. The application sends the user to the authorisation server.
  2. The user signs in there (MFA and conditional access apply) and sees a consent screen: "The app is requesting access to read your calendar".
  3. If approved, the application receives an access token: time-limited and restricted to the approved permissions, called scopes.
  4. The application uses the token against the service. It never saw the password.

Tokens expire quickly and can be revoked centrally, in sharp contrast to a shared password that keeps working until someone remembers to change it.

OAuth, OpenID Connect and OAuth 2.1

An important clarification: OAuth is authorisation ("what may the app do?"), not authentication ("who is the user?"). For the sign-in part, OpenID Connect (OIDC) is used, an identity layer built on top of OAuth. It is the combination that powers "Sign in with Microsoft" and federation across services, and that delivers the SSO experience.

The standard is actively maintained: OAuth 2.1 is being finalised in the IETF and consolidates ten years of security experience into one document: among other things mandatory PKCE protection and removal of the insecure legacy flows (implicit and password grant). Modern identity platforms already follow the requirements.

OAuth's consent model has a downside that attackers actively exploit: consent phishing. Instead of stealing the password, a phishing email lures the user into approving a malicious app ("HR document, click to open"), and the app requests access to email and files. If the user approves, the attacker holds a valid token, and neither a password change nor MFA helps until the app consent is revoked. The defence is central: restrict which apps users may approve themselves in your Microsoft 365 environment, require admin approval for the rest, and review existing app permissions regularly.

How MI Support IT can help

We govern and monitor app access in customers' Microsoft 365 environments: sensible consent policies in Entra ID, clean-up of old app permissions and monitoring of suspicious approvals, as part of your overall IT security. Contact us if you have never reviewed which apps have access to your data.

Shall we talk about your business and your needs?

Real people talking to real people. We get back to you the same day.

Write to usBook a meeting