Anomaly detection in an application with delegate authorization

A method of detecting an anomaly in a delegate application's communication, comprising:

• receiving a communication and a valid access token from a specific delegate application requesting access to a resource;
• building a tenant-specific baseline for an attribute value from communications received from multiple delegate applications attempting to access a tenant resource
• classifying the attribute value of the communication as application anomalous for the specific delegate application based on the tenant-specific baseline;
• determining that an anomalous communication criteria is satisfied, the criteria comprising the attribute value being application anomalous;
• and
• in response to the criteria being satisfied, initiating a security mitigation action in response to the communication.

A system comprising:

• one or more processors;
• and
• one or more computer storage media storing computer-useable instructions that, when used by the one or more processors, cause the one or more processors to perform a method, the method comprising:
• determining a tenant-baseline for an attribute value from event records received from a set of delegate applications;
• receiving an event record for a specific delegate application with access to a resource associated with a tenant, where the specific delegate application is a member of the set of delegate applications;
• classifying, based on the tenant-baseline, the attribute value of the event record as tenant anomalous for delegate applications associated with the tenant;
• determining that an anomalous event criteria is satisfied, the criteria comprising the attribute value being tenant anomalous;
• and
• in response to the criteria being satisfied, initiating a security mitigation action in response to the communication.