Audit OAuth grants in Microsoft Entra by combining a current permission inventory with audit-log evidence. In Entra ID > Enterprise apps, review both organization-wide Admin consent and user- or group-specific User consent. For every grant, identify the publisher, permission type and scope, consenting principal, business owner and data access. Then use audit events to establish who granted or removed access, revoke permissions that are excessive or no longer justified, and record the decision for the next review.
This procedure is specific to Microsoft Entra. Other identity providers can use different terminology, navigation and revocation behavior.
As an Amazon Associate I earn from qualifying purchases.
What an OAuth-grant audit must establish
An OAuth audit answers two different questions: what access exists now and how that access got there. The current state comes from application permissions and delegated permission grants. Audit logs provide the history of consent and removal activity. Neither view is sufficient by itself: a clean inventory cannot prove that an earlier grant never existed, while a log entry does not tell you whether the permission is still active.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsIn Microsoft Entra, organization-wide administrator consent and individual user or group consent are separate views. Include both in every review. Also distinguish the authorization model:
#1 Best Overall
- Application permissions (app-only access) can let a service principal access organizational data without a signed-in user.
- Delegated permissions let an application act on behalf of a user, subject to that user’s access and the consent that was granted.
Microsoft’s consent-evaluation guidance summarizes the governing rule: “If you don’t understand a permission that’s being requested, don’t grant consent.”
1. Define the review and preserve evidence
Write the boundaries before opening the portal. Record the tenant, resource applications (such as Microsoft Graph), date range, application population and grant types in scope. A focused review might cover one suspicious app; a program review may cover every enterprise application and every delegated grant.
For a suspected compromise, preserve evidence before remediation when practical. Capture:
- the suspicious application’s display name, app ID, publisher and service-principal identity;
- the complete permission list, including whether each permission is delegated or application-level and its scope;
- the consenting user, administrator or group context;
- the consent event, relevant sign-ins, affected users and a timeline of access; and
- the current grant or assignment state.
Microsoft notes that determining full incident scope can depend on mailbox auditing and administrator or user activity auditing having been enabled before the event. Audit search results are not immediate, so preserve portal exports or screenshots with timestamps when an investigation is time-sensitive.
2. Inventory every current grant
Review one application in the admin center
- Sign in to the Microsoft Entra admin center with an authorized role that has the least privilege needed for the task.
- Go to Entra ID > Enterprise apps > All applications.
- Select the application and open Permissions.
- Inspect the Admin consent tab for permissions granted on behalf of the organization.
- Inspect the User consent tab for permissions granted by a particular user or group.
- Open each permission’s details rather than relying on the application’s display name. Record the resource, permission value, access type and consent context.
The portal workflow and its permission details are documented in Microsoft’s Review permissions granted to enterprise applications. A familiar icon, domain or app name is not proof that the publisher is authentic.
Export a tenant-wide inventory with Graph or PowerShell
For many applications, use Microsoft Graph or Microsoft Entra PowerShell to enumerate delegated permission grants and application role assignments, then reconcile the results with the portal. Automation is useful for repeatable exports, finding unowned applications and comparing one review period with the next. These methods require appropriately scoped permissions and an authorized administrator; do not grant Global Administrator solely for convenience.
Maintain an internal review record for each grant. Useful fields include app ID, publisher, permission type, permission scope, consenting principal or consent context, last observed use when available, business owner, justification, reviewer, decision and next review date. This record is an operational control, not a substitute for the Entra inventory.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Understand what a permission record represents
Keep the application, service principal, resource API and individual grant distinct in your records. A single application registration can have service principals in multiple tenants, and a resource such as Microsoft Graph exposes many separate delegated scopes and application roles. Record the resource name and permission value exactly as shown, not only a friendly description. Two grants to the same app can have different consent principals, scopes or dates and therefore different risk.
Rank #2
When exports are available, retain the export time and query method. A later comparison should distinguish a newly added permission from one that was merely renamed in a report. If an app has several owners, identify the accountable business owner who can confirm whether the integration still operates and whether every scope remains necessary.
3. Read the audit history
Find permission activity
- In the Entra admin center, go to Entra ID > Enterprise apps > Activity > Audit logs.
- Filter for application-permission activity and set the time range that matches your review.
- For a resource-specific view, search for the resource application that owns the permission, such as Microsoft Graph, and inspect its audit logs.
- For each result, cross-check the actor, date, target application or resource, permission and whether the action represented administrator or user consent.
Microsoft identifies the following event names in its application-permission audit-log guidance:
| Audit activity | What it indicates |
|---|---|
| Add app role assignment to the service principal | An app-only (application-permission) assignment was granted. |
| Remove app role assignment from the service principal | An app-only assignment was revoked. |
| Add delegated permission grant | A delegated permission grant was added. |
| Consent to application | A user granted consent to an application. |
At least the Reports Reader role is required to view the relevant logs. The log is evidence of an action, not an assurance that the resulting permission remains unchanged; compare it with the current inventory.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Correlate events instead of reading them in isolation
Build a short timeline for each material change. Compare an “add” event with the current grant, subsequent “remove” events, sign-in records and changes to the application’s owners or publisher. A user-consent event may explain why a delegated grant appeared, but it does not establish what the app did afterward. Conversely, a removal event may be followed by a new grant with a different scope. Note the actor’s role and whether the target was the app, service principal or resource API so that similarly named entries are not conflated.
4. Evaluate whether each grant is justified
Verify the publisher and ownership
Validate the publisher through a trusted channel, confirm the business owner and check domain provenance. Microsoft’s consent-phishing guidance warns that attackers can spoof names and domains. A verified publisher is a useful signal, but it does not remove the need to examine permissions and business purpose.
Match permissions to the feature
Compare every requested scope with the application’s documented feature and the data it genuinely needs. An app that manages SharePoint sites may need site-reading access, for example, but that function does not by itself justify full mailbox access or directory-impersonation privileges. Broad read/write or “all” scopes warrant careful review; they are not automatic proof of maliciousness.
Prioritize high-consequence context
- Application permissions that can operate without an active user.
- Write, send, delete or management scopes across organizational data.
- Unexpected apps, unexplained consent or permissions granted to privileged users.
- Applications with no current owner, stale justification or no observed business use.
- Delegated grants whose user access or business need has changed.
For each item, document the data at risk, the feature that requires it, the owner who accepts the risk and the date on which that decision must be revisited.
Use a consistent decision test
Ask four questions for every scope: What data or operation does it expose? Which documented feature needs it? Is a narrower permission available? Who accepts the residual risk? A “yes” to business usefulness is not enough if the scope is broader than the feature requires. For delegated access, check whether the consenting user’s current job and data privileges still justify the grant. For app-only access, identify the service workload, its credential or certificate owner and the systems that could be reached without a person present.
5. Choose an action and revoke the right object
Keep and document a justified grant
If the publisher, owner, feature fit and scope are satisfactory, leave the grant in place and record its purpose, least-privilege rationale and next review date. A documented approval is more useful than an unexplained exception because it gives the next reviewer a decision to verify.
Revoke organization-wide administrator consent
For an excessive or stale organization-wide grant, select the application in Enterprise apps, open Permissions, switch to Admin consent and use the portal’s revoke action for the unwanted permission or assignment. Confirm the resulting state in the permission list and, when relevant, in the audit log.
Remove a user-consent grant
Microsoft says the portal’s User consent tab cannot revoke user-consent permissions. Use Microsoft Graph or Microsoft Entra PowerShell with appropriately scoped administrative permissions to remove the specific delegated grant, then verify that the grant no longer appears in the inventory. Follow the current procedures in Microsoft’s enterprise-application permission documentation rather than applying an administrator-consent operation to a user grant.
Do not confuse revocation with visibility or sign-in controls
Hiding an application from a user’s list or restricting who can sign in manages visibility or future use; it does not remove the underlying OAuth grant. Likewise, removing an app from a visible app list is not evidence that all delegated permissions were revoked. Treat permission revocation as a separate change and verify it in the grant inventory.
Verify the change and consider dependencies
After revocation, refresh the portal or rerun the Graph or PowerShell query and record the resulting state. Check whether the application has another grant through a different service principal, resource or user. Coordinate timing with the owner because removing a needed scope can interrupt a production workflow; the owner should test the least-privilege replacement rather than immediately restore a broad grant. Preserve the removal event and the approver’s decision.
6. Respond to a suspicious or compromised grant
- Preserve the consent event, permission details, actor, app identity and relevant sign-in and mailbox or activity evidence before changing state when feasible.
- Identify affected users, access dates, resource applications and data scopes.
- Coordinate with the application owner and security team, then revoke the specific permission or assignment that is not justified.
- Review the application’s activity and search for additional grants or related applications.
- Use disabling a user’s sign-in as a possible short-term containment measure when necessary, while recognizing its productivity impact.
- Record the timeline, action, authorizing role and verification result.
Turning off integrated applications is a drastic measure that disrupts non-Microsoft application use and is not generally recommended. A password reset may protect a user account, but it does not by itself demonstrate that an OAuth grant was removed.
Escalate when the app accessed sensitive mail, files or directory data, when the consenting principal was privileged, or when the publisher cannot be validated. Keep the incident record separate from the routine approval record, but link them by app ID, grant ID or timestamp so later reviewers can reconstruct the decision.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute7. Choose the right review method for the job
| Approach | Best fit | Coverage and repeatability | Revocation capability |
|---|---|---|---|
| Entra admin center | Focused manual review and detailed inspection of one application or user context. | Shows Admin consent and User consent tabs for the selected enterprise application; practical for a small, interactive review. | Can revoke organization-wide administrator-consented permissions. User-consent permissions cannot be revoked from the portal’s User consent tab. |
| Microsoft Graph or Entra PowerShell | Tenant-wide enumeration, exports, reconciliation and repeatable cleanup. | Suitable for broad inventories of delegated permission grants and application role assignments, subject to the permissions granted to the operator. | Can be used to remove specific user-consent grants and automate verification when the operator has appropriately scoped authority. |
Use these methods together with audit logs: inventory establishes current state, while logs establish grant and removal history.
8. Account for timing, retention and missing evidence
Allow for audit-search delay
Microsoft’s illicit-consent guidance states that events can take 30 minutes to 24 hours to appear in Microsoft Purview Audit search results. A blank search immediately after consent is not proof that no event occurred.
Check retention before relying on history
Searchable audit retention depends on the Microsoft 365 subscription and the licenses assigned to users. Confirm the retention that applies to your tenant before interpreting an absent historical event. If auditing was not enabled when the action occurred, a later search cannot reconstruct the missing evidence.
Look beyond Entra OAuth objects
Delegated permissions and application permissions are not the only authorization paths. Include Entra built-in roles, Exchange role-based access control and Teams resource-specific consent in a broader access review. A complete OAuth inventory can therefore coexist with other permissions that still provide access to the same data.
Free tools Windows power users keep installed
One-click scans. No signup required.
9. Make the audit repeatable
Microsoft recommends routine auditing so applications access only the data they need and follow least privilege. Its illicit-consent guidance specifically recommends a weekly consent-grant review for organizations with many applications and a large user base. That recommendation is not a universal schedule for every tenant.
For other organizations, set the cadence as an internal policy based on application volume, data sensitivity, how often permissions change and recent incident history. At each cycle, compare the new inventory with the prior one and flag:
- new grants and permission-scope changes;
- applications with no owner or current business justification;
- unused or unexpectedly active applications;
- consent by privileged users or unusual principals; and
- reviews that are due or overdue.
Assign an owner to every accepted grant, require a reason for exceptions and retain the review decision with its date. This creates an auditable trail without granting broad administrative rights to every reviewer.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.10. Add monitoring where your licensing supports it
Organizations with the appropriate license can supplement periodic reviews with OAuth auditing in Microsoft Defender for Cloud Apps and the Consent Insights workbook in Azure Monitor Workbooks. These capabilities can help surface consent activity between scheduled reviews; they do not replace validating publisher identity, permission fit and business ownership.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →11. Common audit mistakes to avoid
- Reviewing only admin consent: user-specific delegated grants can remain invisible if the User consent view is omitted.
- Trusting the app name: a convincing display name, icon or domain can be spoofed.
- Calling every broad scope malicious: treat broad access as a trigger for evidence-based review, not a verdict without context.
- Assuming a removal event proves complete cleanup: check for duplicate grants, another service principal or a later re-consent.
- Using Global Administrator by default: select a role with the fewest permissions that can perform the inventory or log search.
- Interpreting missing logs as proof of no activity: account for the 30-minute-to-24-hour delay, subscription retention and whether auditing was enabled.
- Stopping at OAuth: inspect built-in roles, Exchange RBAC and Teams resource-specific consent when the data exposure warrants it.
Practical audit checklist
- Define tenant, resources, date range and grant types.
- Preserve suspicious consent and sign-in evidence before remediation when feasible.
- Inventory both Admin consent and User consent in Enterprise apps.
- Classify every permission as delegated or application-level and record its scope.
- Verify publisher, domain provenance, owner and feature-to-permission fit.
- Search the named audit activities and cross-check actor, target, date and consent context.
- Revoke the specific grant through the correct portal, Graph or PowerShell path.
- Do not treat hiding an app, limiting sign-in or resetting a password as grant revocation.
- Check audit delay and retention before concluding that no historical event exists.
- Review other authorization systems and schedule the next review according to risk.
Frequently Asked Questions
How can I audit what apps users have granted permission, and what permissions those apps have?
In the Microsoft Entra admin center, open Entra ID > Enterprise apps, select an application and inspect both the Admin consent and User consent tabs under Permissions. For a tenant-wide view, export delegated permission grants and application role assignments with Microsoft Graph or Entra PowerShell, then reconcile the export with audit logs.
Best Value
What is the difference between delegated and application permissions?
Delegated permissions allow an app to act on behalf of a signed-in user and are constrained by that user’s access. Application permissions give an app-only service principal access to organizational data without an active user, so they deserve especially careful review.
Can I revoke a user’s OAuth consent in the Entra portal?
No. Microsoft states that the User consent tab does not provide revocation. Remove the specific delegated grant with Microsoft Graph or Microsoft Entra PowerShell, using appropriately scoped administrative permissions, and verify the grant afterward.
Which Entra audit events show consent activity?
Look for “Add app role assignment to the service principal,” “Remove app role assignment from the service principal,” “Add delegated permission grant” and “Consent to application.” Cross-check each event with the current permission inventory.
Recommended Free Tools
How long can audit events take to appear?
Microsoft says events can take 30 minutes to 24 hours to appear in Microsoft Purview Audit search results. Retention also depends on the tenant’s Microsoft 365 subscription and user licensing, so an empty historical search is not conclusive.
Does hiding an app revoke its OAuth permissions?
No. Hiding an app or restricting who can sign in changes visibility or future use, not the underlying consent grant. Revoke the permission or assignment through the appropriate Entra, Graph or PowerShell path.
How often should an organization review OAuth grants?
Microsoft specifically recommends weekly consent-grant reviews for organizations with many applications and a large user base. Other tenants should set an internal cadence based on app volume, data sensitivity, permission-change rate and incident history.
What else should be checked besides Entra OAuth grants?
Consider Entra built-in roles, Exchange role-based access control and Teams resource-specific consent. These authorization paths can provide access even when an OAuth inventory appears clean.
The Bottom Line
A reliable Microsoft Entra OAuth audit combines two views: the grants that exist now and the audit events that explain how they were created or removed. Inventory both administrator and user consent, distinguish delegated from application access, validate publisher and business need, and revoke the specific grant through the correct portal, Graph or PowerShell route. Account for log delay and retention, document every decision, and repeat the review at a cadence that matches your tenant’s risk.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
