https://blogs.technet.microsoft.com/office365security/defending-against-illicit-consent-grants/