Microsoft 365 OAuth app consent and permissions review
An application consent and permissions review is a configuration review of which third-party and line-of-business applications, including OAuth apps, can reach your Microsoft 365 tenant data, what permissions they hold, and, where records allow, who granted them. It examines consent settings, high-privilege permissions, app credentials, owners, and unused apps in Microsoft Entra ID, measured against Microsoft’s published guidance.
What Microsoft recommends for app consent and permissions
These points come from Microsoft’s public documentation on consent, permissions, application credentials, ownership, and unused applications. The review checks your tenant against each one that your licensing and the agreed scope include.
Restrict user consent to verified publishers and permissions you select
What the review checks: Which user consent option is selected, and which delegated permissions are classified as low impact, because the verified-publisher option only lets users consent to permissions classified that way.
“Microsoft recommends that you restrict user consent to allow users to consent only for apps from verified publishers, and only for permissions that you select.”
Application consent management and evaluation of consent requests, Microsoft Learn Audit existing app permissions for unwarranted or suspicious access
What the review checks: The permissions granted to each enterprise application, both organization-wide through admin consent and per user or group through user consent, separating delegated permissions from application permissions.
“Audit apps and granted permissions in your organization to ensure that no unwarranted or suspicious applications are already granted access to data.”
Application consent management and evaluation of consent requests, Microsoft Learn Carefully review every non-Microsoft app with a tenant-wide delegated grant
What the review checks: Delegated grants consented on behalf of all users (consent type AllPrincipals) on non-Microsoft apps, flagging permissions Microsoft lists as misused in consent phishing, such as Mail.* and Files.*, and those it rates highest risk, such as Directory.ReadWrite.All.
“Every non-Microsoft application with this permission should be reviewed carefully.”
App consent grant investigation, Microsoft Learn Review requested permissions carefully before granting tenant-wide admin consent
What the review checks: Which apps hold tenant-wide admin consent, which accounts hold roles that can grant it, and whether those apps require user assignment, since by default tenant-wide consent lets all users access an app unless otherwise restricted.
“Therefore you need to carefully review the permissions that the application is requesting before you grant consent.”
Grant tenant-wide admin consent to an application, Microsoft Learn Enable the admin consent workflow for apps users aren’t allowed to consent to
What the review checks: Whether users can request admin consent, who is designated to review requests, whether notifications and expiration reminders are on, and whether reviewers can approve what they receive, since being designated a reviewer doesn’t elevate privileges.
“To allow users to request an administrator's review and approval of an application that the user isn't allowed to consent to, enable the admin consent workflow.”
Configure how users consent to applications, Microsoft Learn Revoke unused and reducible permissions to prevent overprivileged apps
What the review checks: Each granted permission compared with the app’s stated function, flagging permissions that function doesn’t appear to need and ones a lower-privileged permission could replace, such as User.ReadWrite.All on an app that only reads user profiles, where User.Read.All would be enough.
“Prevent overprivileged applications by revoking unused and reducible permissions.”
Enhance security with the principle of least privilege, Microsoft Learn Use certificates, not secrets, when managed identities or federation aren’t possible
What the review checks: The mix of client secrets, certificates, and federated credentials on each app registration, any credentials on apps used only as public clients, and the type, last use, and expiration date of each application credential.
“If using a managed identity or other secure external identity provider isn't possible, use certificate credentials. Don't use password credentials, also known as secrets.”
Security best practices for application properties in Microsoft Entra ID, Microsoft Learn Licensing: Microsoft lists a Microsoft Entra ID P1 or P2 license as a prerequisite for viewing sign-in data in Usage & insights, which reports credential activity.
Use application management policies to limit secret lifetimes or block secrets
What the review checks: Whether application policies block password addition, restrict password and certificate lifetimes, and block custom passwords, whether they apply to all applications, and how any certificate limit compares with Microsoft’s recommended maximum of 180 days.
“Configure application management policies to govern the use of secrets by limiting their lifetimes or blocking their use altogether.”
Security best practices for application properties in Microsoft Entra ID, Microsoft Learn Licensing: The Microsoft Entra Workload ID FAQ lists application management policies as available without a Workload ID Premium license.
Monitor applications so each has at least two owners where possible
What the review checks: Apps with no owner or a single owner, owners who have left the organization, whether a team contact is recorded in serviceManagementReference, and high-privilege apps that hold more permissions than their owners.
“As a best practice, we recommend proactively monitoring applications in your environment to ensure that there are at least two owners, where possible.”
Overview of enterprise application ownership in Microsoft Entra ID, Microsoft Learn Remove unused applications to reduce the tenant’s attack surface
What the review checks: Apps flagged by the Microsoft Entra recommendation to remove unused applications, which covers apps unused for over 90 days, and the last activity date of each service principal, as client or resource.
“Removing unused applications helps reduce the attack surface area and helps clean up the app portfolio of a tenant.”
Microsoft Entra recommendation: Remove unused applications (preview), Microsoft Learn Licensing: Microsoft’s Workload ID FAQ lists app health recommendations, which identify unused or inactive workload identities, as a Workload ID Premium feature.
What the review covers
Line-of-business and third-party applications are reviewed for the permissions they hold in your tenant, not for their own code.
Part of the audit's applications and consent area.
- User consent settings
- Which user consent option applies, whether consent is limited to apps from verified publishers and apps registered in your tenant, and which delegated permissions are classified as low impact.
- Admin consent and who can grant it
- Whether users can request admin consent and who reviews those requests, and which accounts hold roles that can grant consent on behalf of the whole organization.
- Permissions already granted
- Changing user consent settings affects only future consent, so existing grants are reviewed as they stand: delegated and application permissions, whether delegated permissions were granted for all users or for individual users and, where audit records allow, who granted them.
- High-privilege and overprivileged apps
- Non-Microsoft apps holding permissions Microsoft lists as high risk, and permissions that an app’s stated function doesn’t appear to need or that a lower-privileged permission could replace.
- Credentials and expiring secrets on app registrations
- Client secrets compared with certificates and federated credentials, credential expiration and last use, and whether application management policies restrict secrets and their lifetimes.
- Owners and accountability
- Applications with no owner or only one, owners who have left the organization, and whether a team contact is recorded for each application.
- Unused and unattributed service principals
- Applications with no recent sign-in activity, and service principals with no clear owner or business purpose.
When teams ask for it
- Inheriting a tenant with unexplained apps
- After a merger, an acquisition, or a change of IT provider, the tenant holds enterprise applications and consent grants that no one currently on the team can explain.
- After a consent phishing report
- A user reports an unexpected permission prompt or an unfamiliar app. Once any immediate response is complete, the team wants a configuration review of which apps already hold access to data.
- Before tightening user consent
- Teams planning to restrict user consent or turn on the admin consent workflow want to know which apps people rely on, and which permissions to classify as low impact, before anything changes.
- Questions about third-party access
- A customer questionnaire, an auditor, or an internal risk review asks which third-party applications can reach company data and who granted them access.
- An expired app credential
- An integration stops working because a client secret expired, and the team wants to know which other apps rely on secrets, who owns them, and when they expire.
What you receive
Each finding is reported with the configuration evidence behind it, its business context, and a recommended action. Findings are sequenced into a remediation roadmap, so your team knows what to change first.
Questions
Does the review cover which third-party apps can access our data?
Yes, within the agreed scope. The review examines the applications that hold permissions in your tenant, whether each permission is delegated or an application permission, whether delegated permissions cover all users or individual users, and which permissions Microsoft lists as high risk.
It also covers apps with no recent sign-in activity, expiring secrets and certificates, and apps whose owners have left, where the evidence is available. Relevant observations are reported as findings with their evidence.
Do we need particular licenses for this review?
No particular license is needed to request the review. Licensing does determine which reports and controls exist in your tenant, so some evidence is reviewed only where licensed.
For example, Microsoft lists a Microsoft Entra ID P1 or P2 license as a prerequisite for viewing sign-in data in Usage & insights, and its Microsoft Entra Workload ID FAQ marks app health recommendations, which identify unused workload identities, as Premium only. Findings state where a recommendation depends on a license you may not have.
What access does the review need?
It depends on the agreed scope and assessment method. The roles involved, who grants them, and how long access lasts are agreed before the engagement starts.
Access follows least privilege and is time-bound. Read-oriented roles are preferred wherever the assessment method allows.
Will the review revoke permissions or remove applications?
Not without your agreement. The review examines and reports on consent settings, granted permissions, credentials, and owners. Whether the engagement includes any remediation, such as revoking permissions or removing unused apps, and who carries it out, is agreed during scoping before work begins.
How is this different from Microsoft Secure Score or Microsoft Entra recommendations?
Microsoft Secure Score measures your security posture against Microsoft’s recommended actions, and Microsoft Entra recommendations flag specific conditions, such as applications unused for over 90 days. Where they’re available and the agreed access allows, the review can draw on them as evidence.
The review adds business context, looks at how consent settings, permissions, credentials, and ownership interact, backs each finding with evidence, and sequences the remediation. They’re complementary, and the built-in tools remain a useful way to track progress.
How is an application consent and permissions review priced?
Pricing follows scoping. It depends on the size and complexity of your tenant, the control areas included, and the deliverables you need.
Scope, timing, and pricing are all confirmed in writing before the engagement starts.
Get a clear view of your tenant’s configuration.
Tell us about your environment and the questions you need answered. We’ll help define an appropriate assessment scope.
Discuss your audit