Cambridge Analytica (Mar 2018): What App Permissions Mean for Your Microsoft 365 Tenant

Retrospective: this article looks back at events from March 2018, written in 2026 with the benefit of hindsight.

In March 2018, reporting by The Observer and The New York Times revealed that the political consultancy Cambridge Analytica had obtained data on up to 87 million Facebook users. Most of those users had never interacted with Cambridge Analytica — or even with the app that collected their data.

How it happened

A researcher built a personality quiz app on Facebook's platform. About 270,000 people installed it and granted it permission to access their profile data. At the time, Facebook's platform also let apps access data about users' friends. The app collected data on those friends — tens of millions of people — and the data was then shared with Cambridge Analytica in violation of Facebook's policies.

Why it matters for Microsoft 365

The core issue was OAuth consent: users granting an application access to data, often without understanding the scope. Microsoft 365 uses the same model. When a user clicks "Accept" on an app's permission prompt, that app may gain access to their mail, files or calendar — and, with some permissions, to other people's data.

Attackers exploit this with consent phishing: malicious apps that ask for broad permissions and keep access even after a password reset.

Lessons for your tenant

• Restrict user consent to verified publishers and low-risk permissions.
• Use an admin consent workflow so users can request apps and admins review them.
• Audit existing app permissions regularly, focusing on apps with mail, file and directory access.
• Treat app permissions as data sharing decisions, not IT conveniences.

In hindsight

Cambridge Analytica led to a $5 billion FTC penalty for Facebook and reshaped how platforms handle third-party access. In enterprise cloud, the lesson took longer to land: OAuth apps are identities with access, and they need governance like any other.