iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To audit OAuth grants in Microsoft Entra, combine a current permissions inventory with audit-log review. In Entra ID > Enterprise apps, inspect both organization-wide Admin consent and user- or group-specific User consent. Then validate each publisher, permission, scope, owner and business purpose; use audit events to reconstruct who granted or removed access; and revoke grants that are no longer justified.
This procedure is Entra-specific. Other identity providers may use different names, navigation and revocation rules. The goal is not merely to find unfamiliar app names, but to determine exactly what data each grant can reach, who authorized it, whether that access is still needed and whether your records support that conclusion.
What an OAuth-grant audit should establish
A useful audit answers four questions for every connected application:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors- What access exists now? Identify the resource, permission type, scope and consenting principal or context.
- How did it get there? Use audit events to identify the actor, date, target application and permission activity.
- Is the access justified? Confirm publisher identity, business owner, expected feature and least-privilege fit.
- What should happen next? Retain, reduce, revoke or investigate the grant, and record the decision and next review date.
Microsoft’s current procedure for reviewing enterprise-application permissions is documented in Review permissions granted to enterprise applications. A clean inventory is not proof that no earlier grant existed: audit retention, licensing and whether auditing was enabled at the time limit what you can reconstruct.
#1 Best Overall
OAuth grants are one part of authorization. Include other routes that can produce access, such as Entra built-in roles, Exchange role-based access control (RBAC) and Teams resource-specific consent, rather than assuming the enterprise-app list is complete.
Understand the two permission models before reviewing apps
Delegated permissions
A delegated grant lets an application act on behalf of a signed-in user. The effective access is bounded by the user’s privileges and by the scopes consented for that user or group. A user-consented mail or file scope can still expose sensitive information, even though the app is not operating independently of a user session.
Application permissions
An application permission gives app-only access to organizational data without an active user. Because the service principal can operate in the background, broad application permissions deserve especially careful scrutiny and ownership. Microsoft’s consent guidance explains this distinction in Application consent management and evaluation of consent requests.
| Grant type | Typical consent context | Risk question to ask |
|---|---|---|
| Delegated | A user or group consents for use during that user’s sign-in | Which users can the app act for, and are the scopes appropriate to their work? |
| Application | An administrator assigns an app role for the organization | Can the service access organizational data without a user, and is that continuous access necessary? |
Do not label a permission malicious solely because it is broad. Treat broad read, write or “all” scopes as a reason for a deeper review of the publisher, feature-to-permission fit, owner and actual need.
1. Define scope and preserve evidence
Set the review boundary
Write down the tenant, resource applications, grant types and time period in scope. Decide whether the review is a routine control, a targeted check of a sensitive app or an incident investigation. Include both current grants and the historical events needed to explain changes during the period.
Preserve incident evidence before changing access
For a suspicious consent, capture the application identity, publisher, complete permission list, consenting user or administrator, resource application, relevant sign-in activity and the timeline of affected users before remediation when feasible. Export or otherwise preserve the event details that support your incident record. Microsoft notes that determining full incident scope may depend on mailbox auditing and admin or user activity auditing having been enabled before the event.
Do not wait for a search result to appear before recording what you already know. Audit search results can be delayed, and a later absence of an event is not proof that it never occurred.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →2. Inventory current grants in the Entra admin center
Open an application’s permission views
- Sign in to the Microsoft Entra admin center with an authorized role that has only the permissions needed for the review.
- Go to Entra ID > Enterprise apps > All applications.
- Select an application, then open Permissions.
- Inspect the Admin consent tab for permissions that apply across the organization.
- Inspect the User consent tab for permissions granted to a particular user or group.
- Open the permission details rather than relying on the application’s display name or icon.
Admin and user consent are separate views. Reviewing only admin consent misses user-specific grants; reviewing only user consent misses app-only assignments that can run without a signed-in user.
Record a reviewable inventory
For a small, focused review, a controlled spreadsheet can be sufficient. For a tenant-wide review, export and reconcile the data with Microsoft Graph or Microsoft Entra PowerShell. Microsoft documents those approaches for enumerating delegated permission grants and application role assignments in its enterprise-application permissions guidance.
An operational record can include:
- Application and service-principal identifiers, display name and publisher.
- Resource application, permission type and exact scope or app role.
- Consenting principal or consent context (administrator, user or group).
- Business owner, documented purpose and expected feature that requires the access.
- Last observed use, where your telemetry provides it.
- Reviewer, decision, remediation ticket and next review date.
This field list is a practical control design, not a Microsoft-prescribed schema. Keep the raw export or portal evidence so a later reviewer can verify that the record matches the tenant.
3. Reconstruct grant and removal activity with audit logs
Use the enterprise-app activity view
- In the Microsoft Entra admin center, open Entra ID > Enterprise apps.
- Select Activity > Audit logs.
- Filter for permission-related activity and set the time range for your review.
- For each result, capture the actor, date and time, target app or resource, permission or assignment and whether the action added or removed access.
Microsoft’s View Activity logs of application permissions identifies these activities:
| Audit activity | What it indicates |
|---|---|
Add app role assignment to the service principal |
An application (app-only) assignment was granted. |
Remove app role assignment from the service principal |
An application assignment was revoked. |
Add delegated permission grant |
A delegated permission grant was added. |
Consent to application |
A user granted consent. |
Search from the resource application when necessary
Permissions are owned by a resource application. For a resource-specific view, search for that resource application—for example, Microsoft Graph—and inspect its audit logs. The Microsoft procedure states that at least the Reports Reader role is required to view these logs. Use the resource view when an app-centric search does not make the relationship between the target app and the protected resource clear.
Rank #3
Account for timing and retention
Microsoft’s illicit-consent guidance says audit events can take 30 minutes to 24 hours to appear in Microsoft Purview Audit search results. Treat a newly empty search as inconclusive during that window. Searchable retention depends on the Microsoft 365 subscription and the licenses assigned to users; confirm the retention available in your tenant before relying on historical absence. If auditing was not enabled before an incident, logs may not support a complete reconstruction.
4. Assess publisher, purpose and least privilege
Verify who published and owns the app
Validate the publisher and ownership through a trusted channel used by your organization. A familiar-looking name, icon or domain is not authentication: Microsoft’s consent-phishing guidance warns that attackers can spoof names and domains. Prefer a verified publisher when available, but still confirm that the app is the one your business owner requested and that its redirect and operating context are expected.
Map every permission to a feature
Ask the owner to identify the product feature that requires each scope or app role. Compare that explanation with the app’s documented function and the data exposed by the resource. Microsoft’s example is a SharePoint-management app: site-reading access may fit its purpose, while full mailbox access or directory-impersonation privileges may not.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →“If you don’t understand a permission that’s being requested, don’t grant consent.” — Microsoft Learn, Application consent management and evaluation of consent requests.
Prioritize high-consequence cases
- Application permissions that can read or change broad organizational data without a user.
- Write, send, delete or “all” scopes, especially when the feature appears read-only.
- Access involving mail, files, directories, privileged accounts or regulated data.
- Unexpected apps, unexplained consent events or grants made by unusual actors.
- Apps with no current owner, no business justification or no observed use.
- Permission changes that do not match a recorded product change or approval.
Use risk factors to order work, not to declare guilt. A broad scope can be legitimate; it must have a documented need, owner and review decision.
5. Decide whether to retain, reduce, revoke or investigate
Retain a justified grant
Record the owner, purpose, exact scope, consent context, evidence reviewed and next review date. If the app has multiple grants, approve each one separately; approval of the product does not automatically justify every permission it requests.
Rank #4
Reduce excessive access
Where the feature works with narrower scopes, coordinate with the owner to remove unnecessary permissions and request consent only for the reduced set. Verify the resulting inventory after the change and retain the before-and-after record.
Recommended Free Tools
Revoke organization-wide admin consent
For organization-wide permissions, the Entra portal’s Admin consent tab supports revocation. Confirm which app roles or scopes will be removed and coordinate with the owner because revocation can interrupt integrations. Recheck the permission inventory after the operation.
Revoke user or group consent
Microsoft states that user-consent permissions cannot be revoked from the portal’s User consent tab. Use Microsoft Graph or Microsoft Entra PowerShell with appropriately scoped administrator permissions to remove the specific delegated grant. Export the grant first when you need an audit trail, then verify that the user- or group-specific entry is gone.
Do not confuse revocation with visibility or sign-in controls
Hiding an app from a user’s list, restricting who may sign in or disabling a user are different controls. They may limit use or provide short-term containment, but they do not by themselves remove the underlying OAuth grant. A password reset likewise is not evidence that an app’s consent was revoked.
6. Handle a suspected illicit consent
Contain carefully
Preserve the consent and sign-in evidence first when feasible. If a user account appears compromised, disabling that user’s sign-in can be a short-term containment measure, but it has a productivity impact. Coordinate with the incident owner before taking broad action.
Scope the exposure
Review the app’s permissions, grant and removal events, affected users, sign-ins and dates of access. Determine whether the app had delegated access for one user, a group or organization-wide application access. Look for additional grants made by the same actor or related applications.
Best Value
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
Avoid disproportionate shutdowns
Microsoft describes turning off integrated applications as drastic and not recommended because it disrupts the use of non-Microsoft applications. Remove the specific grant or assignment when the evidence supports a narrower action, and document any broader containment decision separately.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Admin center versus Graph or PowerShell
These methods complement each other rather than replacing audit logs. The inventory tells you what exists now; logs help establish when and by whom it changed.
| Approach | Best use | Coverage | Revocation characteristics | Trade-offs |
|---|---|---|---|---|
| Entra admin center | Focused manual review and inspecting permission details | One application at a time, with separate admin- and user-consent views | Admin-consented organization-wide permissions can be revoked in the portal; user-consent permissions cannot | Easy to inspect, but slower to repeat across a large tenant |
| Microsoft Graph | Tenant-wide enumeration, reconciliation and repeatable exports | Broad programmatic inventory of delegated grants and application role assignments | Can target specific grant types when the administrator has appropriately scoped permissions | Requires API permissions, scripting or tooling and careful handling of identifiers |
| Microsoft Entra PowerShell | Repeatable administrative review and user-consent cleanup | Broad scripted queries and exports | Can remove specific user-consent grants when authorized | Requires module knowledge, delegated rights and change-control discipline |
Do not grant Global Administrator by default to perform this work. Microsoft recommends roles with the fewest permissions and reserving Global Administrator for emergency situations when existing roles cannot complete the task.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Build a repeatable review program
Set a risk-based cadence
Microsoft recommends routine audits so applications access only the data they need and follow least privilege. Its illicit-consent guidance specifically recommends a weekly review of consent grants for organizations with many registered applications and a large user base. That is not a universal schedule. Other organizations should set their own cadence using application volume, data sensitivity, rate of change and incident history.
Track changes between reviews
- New admin or user grants since the previous review.
- Permission additions, removals and changes in consent context.
- Applications whose owner, publisher or business purpose changed.
- Unused, unowned or overdue applications.
- Open remediation items and upcoming review dates.
Automate collection, not judgment
Use Graph or PowerShell exports to make inventory collection repeatable, then route high-impact findings to an accountable owner. Automated rules can flag broad scopes, missing owners or sensitive resources, but a human should validate whether the permission matches the feature and business need.
Consider optional monitoring
Organizations with the appropriate licensing can supplement periodic reviews with Microsoft Defender for Cloud Apps OAuth auditing and Azure Monitor Workbooks, including the Consent Insights workbook. These capabilities improve ongoing visibility; they do not eliminate the need to validate grants, retain evidence and make a revocation decision.
Microsoft summarizes the control objective this way: “Routinely audit applications and consented permissions in the organization to make sure that applications are accessing only the data they need and are adhering to the principles of least privilege.” — Microsoft Learn, Detect and remediate illicit consent grants.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Common audit mistakes and their fixes
| Mistake | Why it fails | Correction |
|---|---|---|
| Reviewing only the application name | Names and domains can be spoofed, and the name does not reveal effective scopes. | Validate publisher and ownership, then inspect every permission detail. |
| Checking only Admin consent | User- or group-specific delegated grants remain invisible in that view. | Review both consent tabs and reconcile delegated grants programmatically when scale requires it. |
| Checking only current grants | You cannot tell who added or removed access, or whether a suspicious grant existed earlier. | Pair the inventory with audit events and preserve evidence before remediation. |
| Treating a delayed empty log search as proof | Events may take 30 minutes to 24 hours to appear, and retention varies. | Wait for the documented delay, confirm retention and state what the logs can actually establish. |
| Hiding an app or resetting a password | Those actions do not necessarily revoke OAuth consent. | Use the correct admin-consent or Graph/PowerShell revocation path. |
| Using Global Administrator for every review | It violates least-privilege practice and increases blast radius. | Use the narrowest role that can perform the inventory, log review or remediation. |
| Disabling all integrated applications | Broad shutdowns can interrupt legitimate non-Microsoft integrations. | Contain the affected user or revoke the specific grant when evidence supports it. |
Audit checklist
- Define tenant, resources, grant types and time period.
- Preserve suspicious consent, identity, permissions and sign-in evidence before remediation when feasible.
- Inventory every enterprise app’s Admin consent and User consent views.
- Export and reconcile tenant-wide grants with Graph or PowerShell when manual coverage is insufficient.
- Review the four permission-related audit activities and resource-application logs.
- Confirm actor, date, target, permission and consent context for each material event.
- Validate publisher provenance, owner, feature fit and least-privilege need.
- Prioritize app-only access, broad scopes, privileged users, sensitive data and unexplained grants.
- Retain justified grants with an owner and next review date; reduce or revoke the rest.
- Use portal revocation for organization-wide admin consent and Graph or PowerShell for user consent.
- Recheck the inventory after remediation and record the result.
- Set a cadence appropriate to app volume, sensitivity, change rate and incident history.
Limits you should state in every audit report
- The procedures and navigation described here apply to Microsoft Entra; another identity provider may implement OAuth consent differently.
- Audit-search results can be delayed by 30 minutes to 24 hours.
- Searchable history depends on the tenant’s Microsoft 365 subscription, user licenses and configured auditing.
- Full incident scope may be impossible to establish if mailbox, admin or user activity auditing was not enabled before the event.
- A current clean inventory does not prove that no earlier grant existed.
- OAuth consent is not the only authorization path; include Entra roles, Exchange RBAC and Teams resource-specific consent where relevant.
The broader enterprise risk is a supply-chain problem as well as an identity problem: a trusted business workflow can inherit the permissions of a connected SaaS application. The Cloud Security Alliance discusses this systemic risk in AI SaaS OAuth Supply Chain Systemic Risk. A disciplined inventory, evidence-backed review and grant-specific revocation are the controls that turn that risk into a manageable process.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
