iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A sound OAuth-grant review does more than list app registrations. It inventories every active delegated and app-only authorization, records who approved it and what it can reach, checks whether each scope still matches a legitimate business need, investigates unusual consent events, and revokes or contains access that is excessive, unused, or unexplained. In Microsoft Entra, that requires using the Enterprise apps portal for current permissions, Microsoft Graph or PowerShell for complete and repeatable remediation, and audit logs for the history of grants and removals.
The process below is designed for identity administrators and security teams reviewing Microsoft 365 and other organizational SaaS access. It also provides principles that apply to Google Workspace and other identity providers, while avoiding provider-specific steps that vary by console version.
What an OAuth grant is—and what your review must cover
An OAuth grant is a durable authorization relationship between an application, a resource service, and a user or organization. A person or administrator approves permissions, and the application can then request tokens to read data or perform actions without asking for consent every time.
Review two fundamentally different access models:
- Delegated access: the application acts on behalf of a signed-in user. Its effective access is bounded by both the granted scopes and what that user can access.
- Application (app-only) access: the application acts as itself, without a signed-in user. Application permissions can reach organizational data in the background and may affect many users.
Also distinguish consent scope. An administrator may grant an application permission for the whole organization, while a user may grant the same or different permission only for that user. A list of app registrations is not a grants inventory: an app can be registered but have no active authorization, and an active grant can exist for an app your IT team did not create.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Define authority, scope and evidence before you start
Use the least-privileged review roles
For permission review in Microsoft Entra, Microsoft identifies Cloud Application Administrator and Application Administrator as eligible roles. Viewing application activity logs is a separate task; the documented roles include Reports Reader, Security Reader, Security Administrator and Global Reader. A service-principal owner who is not an administrator may not be able to invalidate refresh tokens, so do not assume ownership alone is sufficient for incident response.
Confirm the actual role assignments and Microsoft Graph scopes in your tenant before running commands that change grants. Use a dedicated review account where practical, and separate read-only discovery from write operations.
Set a review window and boundaries
Choose the date range you will examine and list the identity providers and tenants in scope. Include:
- Third-party applications with current grants.
- Applications no longer used or owned by a departed team.
- Grants made without an approved change or procurement record.
- Permissions that do not fit the application’s stated function.
- Grants affecting privileged users, sensitive data, or service identities.
Preserve a dated export before remediation. It gives you a point-in-time record for the review, supports rollback discussions with application owners, and lets the next review identify additions and removals. No universal retention period is prescribed; align your retention decision with legal, regulatory and incident-response requirements.
Build a complete OAuth-grant inventory
Use the Microsoft Entra portal for a first view
- Sign in to the Microsoft Entra admin center with an eligible administrative role.
- Go to Entra ID > Enterprise apps > All applications.
- Select an application and open Permissions.
- Use the Admin consent tab to see permissions that apply across the organization.
- Use the User consent tab to see grants associated with a specific user or group.
This view is useful for human review, but it is not the best method for a large tenant-wide export or for repeatable cleanup.
Use Graph or PowerShell for scale
Microsoft documents Microsoft Graph objects for the two principal grant types:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
oauth2PermissionGrantsrepresents delegated permission grants.appRoleAssignmentsrepresents application permissions assigned to a service principal.
Graph queries and the corresponding PowerShell cmdlets can enumerate these objects and remove them. Capture the object identifiers, client application, resource API and principal before deleting anything. Test commands against a nonproduction or narrowly filtered object first, and log the operator, timestamp and result of each change.
Recommended Free Tools
Record fields that support a decision
A practical inventory row should contain the following:
| Field | What to capture | Why it matters |
|---|---|---|
| Application identity | Display name, stable application/client identifier and service-principal identifier | Names can be duplicated or changed; identifiers provide continuity. |
| Publisher | Publisher name and whether its identity was independently verified | Publisher context helps distinguish an approved supplier from an impersonator. |
| Resource and permissions | Target API plus every scope or app role | Risk depends on the exact resource and operation, not only the app name. |
| Grant type | Delegated/user context or application/app-only | App-only access can operate without a user session. |
| Consent scope | One user, a group, or the whole organization; admin or user consent | Scope determines blast radius and the revocation path. |
| Actor and principal | User, group, administrator or service identity associated with consent | Identifies who authorized access and who may be affected. |
| Timing and use | Creation or latest authorization/change date, plus recent sign-in or usage context when available | Separates active business use from abandoned access. |
| Ownership and purpose | Business owner, approved purpose and feature requiring each permission | Enables least-privilege and accountability decisions. |
| Review decision | Keep, reduce, revoke or investigate; reviewer, date, reason, owner and follow-up date | Turns a snapshot into an auditable control. |
Assess whether each grant is justified
Verify the application and publisher
Ask whether the team recognizes the application, publisher and business owner. Confirm the publisher through an independent channel rather than relying only on a display name. Generic, misspelled or unexpectedly similar names deserve extra scrutiny, but a suspicious name is a reason to investigate—not proof that the app is malicious.
Map every permission to a feature
For each scope or app role, write down the feature that needs it and whether a narrower permission would work. An application used for SharePoint site management may need site access; that fact alone does not justify broad mailbox access or directory impersonation. If the owner cannot explain a scope in concrete terms, mark it for reduction or investigation.
Evaluate blast radius
- Data sensitivity: mail, files, directory information and role-management capabilities carry materially different consequences than basic profile access.
- Execution model: app-only permissions can run unattended; delegated permissions inherit the user’s authority.
- Population: one user, a small group or every principal in the tenant.
- Identity sensitivity: grants made by administrators or assigned to privileged users warrant tighter review.
- Business status: unused applications, departed owners and suppliers outside approved processes are higher-priority cleanup candidates.
Do not treat the existence of a consent event as evidence of compromise. Treat unexplained, excessive or anomalous combinations of publisher, scope, actor and timing as investigation triggers.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Reconstruct who granted access and when
Use Entra audit logs for grant history
Go to Enterprise apps > Activity > Audit logs. Relevant activities include:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
| Activity | Meaning |
|---|---|
Add app role assignment to the service principal |
Application (app-only) access was granted. |
Remove app role assignment from the service principal |
Application access was revoked. |
Add delegated permission grant |
Delegated access was granted. |
Consent to application |
A user-consent event occurred. |
These events are recorded under Core Directory / ApplicationManagement. When investigating a particular resource API, such as Microsoft Graph, filter on that resource application to identify client applications that received permissions to it.
Search Purview Audit for questionable consent
Microsoft’s illicit-consent guidance directs investigators to search Microsoft Purview Audit for questionable Consent to application activities and inspect the IsAdminConsent value. An event may take 30 minutes to 24 hours to appear. Searchable retention depends on the Microsoft 365 subscription assigned to the tenant, so confirm your actual retention window before relying on older events.
For a suspicious grant, correlate the current permission state with the affected user or users, authorization date, access period and subsequent sign-in or data activity. Password reset or MFA does not remove an external application’s authorization; the grant itself must be revoked while related activity is investigated.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsDecide: keep, reduce, revoke or investigate
Keep
Keep a grant when the publisher and owner are known, the permission is necessary for a documented feature, the consent scope is appropriate and recent use supports the stated purpose. Record the reviewer and next review date.
Reduce
For an approved application with excess scopes, remove only the unnecessary permission when the provider supports granular changes. Coordinate with the owner because reducing a scope can disable a feature or break an automation.
Revoke
Revoke grants for unrecognized, abandoned, unauthorized or clearly excessive applications after preserving evidence and assessing business impact. For an application used by a critical service, establish an owner and recovery plan before removal unless incident response requires immediate containment.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Investigate
Escalate when the publisher cannot be verified, a privileged identity granted unusual access, a high-value scope appeared outside normal change procedures, or the application name and behavior suggest impersonation. Investigation should cover the app’s permissions, affected principals, access dates and downstream activity—not just the consent record.
Revoke grants safely in Microsoft Entra
Organization-wide admin consent
Open the application in Entra ID > Enterprise apps > All applications, select Permissions, and use the Admin consent view to revoke the organization-wide permission. Preserve the pre-change inventory and audit event first.
User consent
The portal does not revoke entries shown under User consent. Use the documented Microsoft Graph or PowerShell process to locate the relevant oauth2PermissionGrants object and remove it. Validate that you selected the intended client, resource and principal before executing a delete operation.
Application permissions
For app-only access, identify the relevant appRoleAssignments object and remove the assignment through Graph or PowerShell. Removing an assignment changes the application’s ability to obtain or use that permission; verify the resulting state and check the application’s service owner for failures.
Containment after suspected illicit consent
- Preserve the current grant record and relevant audit events.
- Revoke the application’s delegated and/or app-only grant as appropriate.
- Assess affected users, scopes, access dates and related activity.
- Invalidate refresh tokens where your response plan and permissions support it.
- Confirm the grant is gone and determine whether any data-access or account-response actions are still required.
Revocation is not the same as complete incident response. Verify the effect with current provider documentation and application behavior, and keep the investigation open until related activity has been assessed.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallPrevent immediate re-consent
Removing an existing grant may not stop users from consenting again when user consent remains enabled. Review the tenant’s user-consent policy separately, and evaluate whether user assignment should be required for the application. Tenant-wide admin consent should be granted only after the publisher, permissions, business purpose and blast radius are understood. Microsoft’s guidance emphasizes careful evaluation even when many users have already consented individually.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Between formal reviews, route new grants to an accountable owner, monitor consent and permission-change events, and maintain an approved-application and maximum-scope policy. Continuous visibility tooling can alert near the time a grant is created, but it should complement—not replace—provider audit logs and an ownership process.
Choose the right control for the job
| Control | Best use | Strength | Limitation |
|---|---|---|---|
| Entra Enterprise apps portal | Human inspection and straightforward admin-consent changes | Shows admin-consent and user-consent views in context | Not ideal for tenant-scale export; user-consent entries cannot be revoked there. |
| Microsoft Graph or PowerShell | Inventory, filtering and repeatable remediation | Works with delegated grants and app-role assignments at scale | Requires correct scopes, identifiers and change-control discipline. |
| Entra audit logs | Historical reconstruction | Shows grant, removal and consent activities and their actors | Events can be delayed 30 minutes to 24 hours and retention depends on licensing. |
| Purview Audit | Investigation of questionable consent | Supports searches for Consent to application and the IsAdminConsent value |
Searchable history varies by subscription and tenant configuration. |
Apply the same inventory principle across providers
The Cloud Security Alliance recommends that enterprise audits across Google Workspace and Microsoft Entra enumerate every third-party application, its permissions, the users who authorized it and the most recent authorization event. It specifically calls for revoking grants for unused applications, apps unknown to IT and scopes inconsistent with the app’s function.
Provider labels, administrator roles and revoke workflows differ. Keep your cross-provider procedure centered on the inventory fields, risk questions, evidence preservation and ownership decisions above, and verify the current administrator-console path before publishing or automating provider-specific commands.
Set a review cadence that matches risk and scale
Microsoft recommends weekly consent-grant reviews for organizations with many registered applications and a large user base. Smaller or lower-change environments can set a different interval based on grant volume, sensitivity and recent incidents, but should still review immediately after a suspicious event or major permission change.
Between scheduled reviews
- Alert on new consent, app-role assignments and permission changes.
- Require a named business owner and purpose for every new application.
- Route broad mail, file, directory and role-management permissions for heightened approval.
- Track grants that are temporarily approved with an explicit expiry or follow-up date.
- Compare each new export with the previous dated inventory.
Operational checklist
- Assign least-privileged roles for discovery, logs and remediation.
- Define tenants, identity providers and the review window.
- Export delegated and app-only grants before making changes.
- Capture application, publisher, resource, scopes, consent type, principal, timing, owner and purpose.
- Separate organization-wide admin consent from user- or group-specific consent.
- Map every permission to an expected feature and look for narrower alternatives.
- Prioritize sensitive data, unattended app-only access, privileged users and unexplained publishers.
- Use audit logs to establish who granted or removed access and when.
- Account for the 30-minute-to-24-hour event delay and your tenant’s retention limits.
- Keep justified grants, reduce excess scopes, revoke unnecessary access and investigate anomalies.
- Use Graph or PowerShell for user-consent and app-role remediation when the portal cannot perform the change.
- Review user-consent policy so revoked access cannot simply be recreated without appropriate approval.
- Record the decision, reviewer, evidence, owner and next review date.
Conclusion
An effective OAuth review is an ownership and evidence process, not a one-time app list. The reliable sequence is to inventory active delegated and app-only grants, understand exactly what each permission reaches, reconstruct consent history, remove or contain unjustified access, and monitor new grants on a cadence appropriate to your tenant. Keeping those records separate from app-registration data is what reveals dormant, user-only and organization-wide authorizations that otherwise remain invisible.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
