app-audit
Every app registration and every enterprise app in Entra ID is a way into the tenant that does not go through a user's MFA. Drop an export here and see which apps could take over the tenant, which read everyone's mail, where users were tricked into consent, which secrets are about to expire and which apps nobody uses any more. The file is read by your browser and never uploaded.
getting the export
The portal has no single export that contains credentials, permissions and consents together, so this page comes with a script. It only reads. Run it in PowerShell 7 with the Microsoft.Graph module, as a Global Reader or with the three scopes it asks for, then drop the resulting apps.json above. The file holds names and expiry dates of credentials, never the secrets themselves: Entra ID does not give those out.
what it checks
| Check | Triggers when |
|---|---|
| Tenant takeover | An app holds an application permission that lets it grant itself more (role management, app role assignment, application write, authentication methods, Conditional Access, federation) or holds an administrator directory role. Critical when the app belongs to another organisation. |
| Broad data access | Application permissions on all mailboxes, files, sites, chats or the whole directory. |
| Credentials on enterprise apps | A valid secret or certificate sits on the enterprise app object of an app you do not own. SAML apps and managed identities are excluded. |
| User consent to unverified apps | Individual users granted an outside app from an unverified publisher access to mail, files or contacts. |
| Admin consent for sensitive scopes | An outside app has tenant-wide delegated access to mail, files or directory data. |
| Expiring credentials | A secret or certificate of your own app ends within 30 days. |
| Long-lived secrets | A client secret is valid for more than two years. |
| Unused apps | An app with permissions or valid credentials has not signed in for 90 days, or never. |
| No owner | An app registration has no owner. |
| Sign-in settings | Wildcard or unencrypted redirect addresses, or the implicit grant issuing access tokens. |
| Expired credentials | Expired secrets and certificates that are still listed. |
| Multi-tenant apps | Your own app registration accepts users from other organisations. |
A finding says an app is able to do something, not that it has. A backup product needs to read every mailbox, and an identity tool needs to write to the directory. The point of the list is that each of these apps should have an owner who can say why, and a credential that is looked after. Microsoft's own apps are left out of the export unless they carry a credential or a role, because a credential added to one of them is a known way to hide. The permission lists are a selection of the ones that matter most and are not complete.
Related: attack map Graph permissions reference OAuth flow explained consent phishing PIM cheat sheet CA analyzer