Adobe

What's known

Application ID

706e0542-2dfb-4e7f-98f0-1e17eab6d5b8

Owner tenant ID

d8320d6d-7982-471e-965c-d001308ed36e

Found

2025, 1 year ago. The year the source last saw it, and the only date on record.

Where this comes from

• Named in Wiz's research into malicious Azure OAuth applications. Read the source. Checked 9 November 2026.

If it's in your tenant

These commands find it, show which permissions it was granted, then disable it. Disabling keeps the app and its audit trail for your investigation, so remove it afterwards. Then review what it accessed and revoke the sessions of anyone who consented.

Connect-MgGraph -Scopes "Application.ReadWrite.All"
$sp = Get-MgServicePrincipal -Filter "appId eq '706e0542-2dfb-4e7f-98f0-1e17eab6d5b8'"
$sp | Format-List DisplayName, Id, AppId, AccountEnabled
Get-MgServicePrincipalOauth2PermissionGrant -ServicePrincipalId $sp.Id
Update-MgServicePrincipal -ServicePrincipalId $sp.Id -AccountEnabled:$false