arXiv: Lost in Permissions: Exploring the Microsoft 365 App Ecosystem

A new academic study, published on arXiv in August 2026, examines the security and privacy risks within the Microsoft 365 app ecosystem, specifically focusing on how third-party applications request and use permissions. The research, titled "Lost in Permissions," analyzes a large dataset of these apps and finds that many request excessive or overlapping permissions, often beyond what is necessary for their stated functions. This creates a significant attack surface where a compromised or malicious app could access sensitive organizational data, including emails, files, and user profiles, without proper oversight.

The findings directly affect any organization that deploys Microsoft 365, particularly those in regulated sectors such as finance, healthcare, and public administration, where data protection obligations under GDPR, NIS2, and sector-specific rules are strict. The risk is not limited to direct data breaches; it also impacts supply chain security, as third-party apps are often integrated into core workflows. Compliance teams must treat this as a governance issue, not just an IT concern, because the permissions granted to these apps can violate the principle of data minimization and undermine accountability requirements.

Compliance teams should immediately initiate a review of all approved Microsoft 365 third-party apps, cataloguing their requested permissions against their actual business purpose. They should implement a stricter approval process that requires a documented justification for every permission, and enable automated monitoring tools to flag apps with excessive or unusual access patterns. Additionally, they should update their vendor risk assessments to include this specific threat model and provide training to employees on the risks of granting broad permissions. Finally, they should document these actions as part of their ongoing compliance evidence, ready for audit or regulatory inquiry.