How entries get listed

An app is listed only when a published source names its application ID as malicious or abused, and we have confirmed that source really says so. The source is linked from the entry, with the date it was checked.

The three flags

Rogue apps were built by attackers. There's no innocent reason to have one, so disable it.

Abused apps are real products, such as desktop mail clients, backup tools and contact finders, that attackers often use once they're into an account. Plenty of people use them legitimately, so check who consented and why before acting.

Watch apps are Microsoft's own, and attackers use them too, for example to phish tokens or to blend in. They're part of Microsoft 365, so never remove them: watch their sign-ins instead.

Dates

Each reference and age uses the earliest date on record for that app, not the date we added it. Sources don't always say when they first saw one, so every entry shows what its date really is. "Reported" means the date a source published it, and the app may have been active before that.

What isn't here

Application IDs seen only in spoofed sign-in attempts. Those IDs were invented for the attack and belong to no app.

Owner tenant domains. The tenant that held a malicious app is often a compromised victim, so we publish only its ID.

What "not on the list" means

Very little. Anyone can register a new app in minutes, so most rogue apps will never appear on any list. Use this to catch the known ones, then check every app's publisher, permissions and consent history.

Corrections

If you own an app or tenant listed here, or a source has been misread, email corrections@m365rogueapps.com with the reference and we'll look at it. Entries we remove stay retired, and their reference is never reused.

Thanks

The first entries came via OAuthSentry and mthcht/awesome-lists, and rest on research by the sources credited on each entry.