Microsoft 365 connected apps security: what IT admins need to know Microsoft 365 connected apps security  is now a core admin priority because OAuth permissions can create standing access to mail, files, and directory data until app grants are reviewed and revoked. Yet most Microsoft 365 security conversations still orbit the same center of gravity: passwords, MFA, and user sign-ins. But attackers are quietly shifting one layer deeper—toward Microsoft 365 / Entra ID connected