AN0529: Analytic 0529
OAuth token usage for Exchange Online or SharePoint API access without preceding login or from unauthorized clients.
Analyst context for executives and security teams
This analytic matters because it focuses on OAuth token use against Exchange Online or SharePoint APIs when there is no preceding login activity or when the client is unauthorized. For leaders, the decision value is whether the organization can distinguish expected cloud productivity access from token-based access that bypasses normal interactive sign-in visibility.
Executive priority
Prioritize this as a cloud and identity monitoring validation item for Office Suite environments using Exchange Online or SharePoint. The key business question is whether security teams can produce reliable evidence of API access, token usage, preceding login context, and authorized client status during an investigation or audit. If those data sources are incomplete, incident response may struggle to determine whether access was legitimate or suspicious.
Technical view
SOC and detection teams should validate whether they can correlate OAuth token usage for Exchange Online or SharePoint API access with prior login events and approved client information. Because ATT&CK provides no tactic mapping, relationship context, or official detection logic for this analytic, implementation should be treated as a local engineering exercise: define what counts as a preceding login, define the authorized client inventory, and test alert behavior against known legitimate Office Suite access patterns.
Likely telemetry
- OAuth token usage records for Exchange Online and SharePoint API access
- Office Suite sign-in or login event history
- Client application identifiers or authorized client inventory
- User, tenant, source, and timestamp context needed to correlate API access with preceding login activity
Detection direction
- Validate correlation between API access events and preceding login events within a locally defined time window.
- Flag OAuth token usage from clients not approved for Exchange Online or SharePoint access.
- Tune for legitimate non-interactive or service-driven access so the analytic does not create excessive false positives.
- Confirm whether gaps in sign-in logging, API telemetry, or client inventory would prevent confident triage.
Mitigation priorities
- Maintain an accurate inventory of authorized clients allowed to access Exchange Online and SharePoint APIs.
- Ensure Office Suite identity and API activity logs are retained and available to SOC and incident response teams.
- Review OAuth application and client authorization processes so unauthorized clients are identifiable.
- Use findings from detection testing to strengthen cloud security monitoring and incident response evidence requirements.
Analyst notes and limits
The supplied ATT&CK object is a detection analytic, AN0529, for Office Suite environments. Its description is specific to OAuth token usage for Exchange Online or SharePoint API access without preceding login or from unauthorized clients. No relationships, tactics, aliases, or official detection content were supplied, so this take emphasizes validation questions and telemetry readiness rather than a fixed detection rule.
This summary is limited to the official STIX fields and external reference provided. It does not establish adversary attribution, active exploitation, impact, or guaranteed detection coverage. Local tenant configuration, logging availability, authorized client definitions, and retention settings are required to operationalize the analytic.
Analytic 0529
OAuth token usage for Exchange Online or SharePoint API access without preceding login or from unauthorized clients.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | e2ef59b86ca9… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN0529Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.