Apps with High-privilege Application Permissions

The question it answers: Which apps hold application permissions that let them take over the tenant or read and write all data without a signed-in user?

Application permissions work without a signed-in user and ignore Conditional Access. An app with Mail.Read can read every mailbox; one with RoleManagement.ReadWrite.Directory or AppRoleAssignment.ReadWrite.All can make itself Global Administrator. This is the counterpart to the OAuth Consent Grants report, which covers delegated permissions.

Note

Tiers: ‘Tenant takeover’ = can escalate its own or others’ rights; ‘All data’ = reads/writes every mailbox, file, site or chat; ‘Write’ = any other write permission. Last sign-in needs Entra ID P1.

At a glance

Where in the app	Entra ID › App & Workload Identities › High-privilege App Permissions
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	None; the last sign-in column needs Microsoft Entra ID P1.
Report id (API and MCP)	entra.security.app-permission-exposure

Columns

Column	Key	Type
App	DisplayName	Link
Tier	Tier	Status
Why	DangerousPermissionsString	Text
Valid credentials	ActiveCredentialCount	Text
Last app sign-in	LastSignIn	Date
First granted	FirstGranted	Date
All permissions	PermissionsString	Text
Type	ClientType	Text

Filters

Filter	Key (API)	On when the page opens
Hide read-only apps	hide-read	Yes

What it needs

Licence: None; the last sign-in column needs Microsoft Entra ID P1.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Application.Read.All	Microsoft Graph	Read all applications
AuditLog.Read.All	Microsoft Graph	Read all audit log data

Data sources it reads

• GET /v1.0/servicePrincipals(appId=...)?$select=appRoles
• GET /v1.0/servicePrincipals/{resource}/appRoleAssignedTo (Graph, Exchange Online, SharePoint Online)
• GET /beta/reports/servicePrincipalSignInActivities

Through the API and MCP

GET /ir-api/v1/reports/entra.security.app-permission-exposure?size=100
GET /ir-api/v1/reports/entra.security.app-permission-exposure?filter=hide-read

An AI assistant reads it with the MCP tool get_report and the id entra.security.app-permission-exposure. The client needs the Read grant for Entra ID. See Using the API.