← All keys & policies
Policy·organization
OAuth app access restrictions
Tier 1 · HighManagement
Why Tier 1
Decides which OAuth apps can use members' access to the organization. Turned off, any OAuth app a member authorizes reaches the organization's repositories with that member's access.
The organization setting that limits organization access to OAuth apps an owner has approved.
Available on: Free, Team, Enterprise Cloud, EMU. Source
Attack path
A consent-phishing OAuth app, or a compromised third-party app, gets a member's token. Without restrictions that token works on the organization straight away; with them, it does nothing until an owner approves the app.
Mitigations
- Turn on OAuth app access restrictions
- Review approved OAuth apps and remove unused ones
Detect
Alert on org.disable_oauth_app_restrictions, org.oauth_app_access_approved in the audit log.