Cleaning up over-consented app permissions

4slides. Screenshot a slide, download it as a PNG, or use your browser's Print → Save as PDF for a LinkedIn-ready multi-page carousel — each slide becomes one page.

solvingmicrosoft365.com

1 / 4

Cleaning up over-consented app permissions

How to find apps holding more Graph permission than they use — delegated and application grants, who consented, what is called — and reduce them safely.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/entra-id-over-consented-app-permissions-cleanup

Slide 1Download PNG

solvingmicrosoft365.com

2 / 4

How do I find over-permissioned apps in Entra ID?

List every service principal's application permissions and delegated grants with Graph (appRoleAssignments and oauth2PermissionGrants), then compare with what the app actually calls using the Microsoft Graph activity lo…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/entra-id-over-consented-app-permissions-cleanup

Slide 2Download PNG

solvingmicrosoft365.com

3 / 4

What are the most dangerous Graph permissions?

Application permissions that touch every user: Mail.ReadWrite, Mail.Send, Files.ReadWrite.All, Sites.FullControl.All, Directory.ReadWrite.All, RoleManagement.ReadWrite.Directory, and Application.ReadWrite.All (which let…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/entra-id-over-consented-app-permissions-cleanup

Slide 3Download PNG

solvingmicrosoft365.com

4 / 4

How can I limit an app's mailbox access to specific mailboxes?

With Exchange application access policies (New-ApplicationAccessPolicy), which restrict an app holding Mail.* or Calendars.* application permissions to a mail-enabled security group of mailboxes. For SharePoint, Sites.S…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/entra-id-over-consented-app-permissions-cleanup

Slide 4Download PNG

Auto-generated from Cleaning up over-consented app permissions. This page is not indexed and isn't part of the guide itself.