Consent sprawl is the buildup of too many app approvals, OAuth grants, and delegated permissions across SaaS, cloud, and AI tools. Each approval may look harmless on its own, but over time organizations accumulate a large, poorly understood set of access paths. Some grants are user-consented, others are admin-approved, and many include broad scopes or long-lived refresh tokens.
It matters because forgotten permissions can outlive the business need that created them. Attackers often abuse stale or overbroad consent to keep reaching mailboxes, files, CRM data, or APIs even after passwords are changed. Defenders reduce this risk by inventorying all grants, limiting high-risk user consent, using least privilege, reviewing scopes regularly, and revoking or rotating tokens when apps are retired or compromised.