How to Audit Third-Party OAuth App Permissions

What is an OAuth app permission?

An OAuth app permission is access that a person or an admin gave a third-party app to call an API on their behalf. Someone clicks Accept on a consent prompt, and your tenant records a grant. The grant lasts until someone removes it.

To audit OAuth app permissions, you need to know which kind each grant is. Microsoft's permissions and consent overview splits them in two.

Take Files.Read.All. As a delegated permission, the app reads only the files the user can open. As an application permission, it can read any file in the tenant. The name stays the same while the reach changes completely.

Which OAuth scopes carry the most risk?

Permissions that reach mail, files and the directory carry the most risk. These come from the Microsoft Graph permissions reference, in their delegated form.

Look at the last column. By default, Entra ID lets users consent to any permission that does not require admin consent. A person can hand a stranger's app their whole mailbox with one click.

offline_access deserves its own line. Microsoft's scopes reference says it is implicitly granted with any delegated permission. The refresh tokens it allows are typically valid for 90 days. The app keeps working when the person stops using it.

The application versions of Mail.Read and Files.ReadWrite.All always need an admin. They reach every mailbox and every site collection, with nobody signed in.

Where do you find OAuth grants in Microsoft Entra ID?

Grants live on each enterprise application. Microsoft's review guide gives the path.

1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
2. Go to Entra ID, then Enterprise apps, then All applications.
3. Open an app and select Permissions.
4. Read the Admin consent tab for permissions granted for the whole organization.
5. Read the User consent tab for permissions that single users or groups granted.

The portal works one app at a time. For the whole tenant, use Microsoft Graph or PowerShell. GET /servicePrincipals/{id}/oauth2PermissionGrants returns delegated grants. GET /servicePrincipals/{id}/appRoleAssignments returns application permissions.

Put the results in one sheet. Give each row the app, its publisher, each permission, its type and who consented. Add the app's recent sign-ins from the sign-in logs.

If you also run Google Workspace

Google's admin help points to Security, then Access and data control, then API controls. The Accessed apps list shows apps that have reached Google data, with user counts and requested services. Each app can be set to Trusted, Limited, Specific Google data or Blocked.

How do you decide whether to keep, limit or remove a grant?

Ask four questions about each app, in order.

1. Do you trust the publisher? Check for a verified publisher. Microsoft warns about malicious apps that imitate known ones. An unverified app with mail or file access fails here.
2. Does someone own it? A grant with no business owner has nobody to answer for it.
3. Is anyone using it? No sign-ins in months means nobody needs it.
4. Do the permissions match the job? Microsoft's consent guidance gives an example. A site management tool might need to read all site collections, but not every mailbox.

There is one catch. The admin center cannot revoke grants on the User consent tab. Use DELETE /oAuth2PermissionGrants/{id} in Graph, or Remove-MgOauth2PermissionGrant in PowerShell.

Here is how three grants from one audit might land.

• A meeting note-taker from an unverified publisher holds Mail.Read and offline_access. Forty people consented and nobody owns it. Remove.
• A file converter holds Files.ReadWrite.All. David Kim granted it and left the company in August. Remove.
• A reporting tool holds the application permission Mail.Read to export one finance mailbox. Nina Patel owns it. Limit it with an application access policy, which Microsoft supports for mailbox permissions.

How do you stop risky grants from coming back?

Change who may consent, then give people a way to ask. The user and admin consent overview lists three user consent options.

• Disable user consent. Only admins with a role that allows consent can grant new permissions.
• Allow consent for verified publishers and your own apps, for permissions you select. You classify which permissions count as low impact. Microsoft recommends this option.
• Allow consent to all apps. Users can grant any permission that does not need an admin.

You set this under Enterprise apps, then Consent and permissions, then User consent settings. The change applies to future consent only. Grants made before it stay until you remove them.

Next, turn on the admin consent workflow under Admin consent settings. A user who cannot consent can then ask for approval from the consent screen. You choose the reviewers, the email reminders and how many days a request stays open. Only a Global Administrator can approve a request for Microsoft Graph application permissions.

How often should you audit OAuth grants?

Run the full audit each quarter, and check the new grants each week. A grant gives access from the moment someone clicks Accept.

Three events should also start a review of one app:

• A leaver. Remove the grants they approved on their last day, as a fixed step in your leaver process.
• A request for new permissions. Apps can use dynamic consent to ask for more at run time. Check the new permissions against the job.
• A breach at the vendor. Look at who granted the app access, and what it can reach.

For AI tools, which arrive fastest, see shadow AI discovery.

How EnscureX Discover helps with the audit

Discover builds the app list from email metadata, OAuth grants from Entra ID, sign-in logs and a browser extension. For each application it shows the scopes with their risk level, who consented, when and from where. AI tools are flagged as they arrive in the catalog.

Each application gets a risk score from 0 to 100. The score weighs scope risk, publisher verification, adoption and the context of the consent. In the app catalog, each app carries an owner and a status: sanctioned, under review or blocked. Vendor intelligence adds breach records, published CVEs and status-page incidents for each vendor.

You can revoke every OAuth grant to an app in one action. That write-back task ships switched off, and works once you turn it on for the Entra ID connection.

Whatever you use, start with the User consent tab on the apps that hold mail and file permissions.