rencore.com (opens in a new tab) Start a trial (opens in a new tab)
Reference

Enterprise application OAuth2 permission scope

Last updated Inventory Entra ID

AI summary

Rencore inventories OAuth2 permission scopes for enterprise applications in your Entra ID through regular scanning. For each permission scope, collected data includes consent descriptions for users and administrators, risk scores, approval requirements, and scope values used in access tokens. You can use this data to understand what delegated permissions your applications have been granted and assess the associated security risks.

All enterprise application OAuth2 permission scopes in Entra ID

Part of the Entra ID inventory.

Scan settings

Default scanning interval Allowed scanning intervals Data removal during incremental scan
Default Daily, Weekly, Bi-Weekly, Monthly, Never, Initial Yes

Properties

Property Type Description Automation placeholder
Admin Consent Description String A description of the delegated permissions, intended to be read by an administrator granting the permission on behalf of all users. This text appears in tenant-wide admin consent experiences. {{EnterpriseApplicationOAuth2PermissionScope.AdminConsentDescription}}
Admin Consent Display Name String The permission's title, intended to be read by an administrator granting the permission on behalf of all users. {{EnterpriseApplicationOAuth2PermissionScope.AdminConsentDisplayName}}
App Enterprise application The unique identifier for the application. {{EnterpriseApplicationOAuth2PermissionScope.App}}
App Name String The display name exposed by the associated application. {{EnterpriseApplicationOAuth2PermissionScope.AppName}}
Initially Scanned DateTime Shows when this object was initially found in a scan. {{EnterpriseApplicationOAuth2PermissionScope.CreatedTime}}
Display Name String {{EnterpriseApplicationOAuth2PermissionScope.DisplayName}}
Is Enabled Boolean When creating or updating a permission, this property must be set to true (which is the default). To delete a permission, this property must first be set to false. At that point, in a subsequent call, the permission may be removed. {{EnterpriseApplicationOAuth2PermissionScope.IsEnabled}}
Last scan update DateTime Shows when this object was last updated in a scan. If an object is found during a scan but no property has been changed this date will not change. {{EnterpriseApplicationOAuth2PermissionScope.LastModifiedTime}}
Id String Unique delegated permission identifier inside the collection of delegated permissions defined for a resource application. {{EnterpriseApplicationOAuth2PermissionScope.OAuth2PermissionScopeId}}
Risk Score Int32 Stores risk score {{EnterpriseApplicationOAuth2PermissionScope.RiskScore}}
Risk Score Update DateTime Stores risk score update {{EnterpriseApplicationOAuth2PermissionScope.RiskScoreLastUpdate}}
Risk Score Value String Stores risk score value like Low_Low {{EnterpriseApplicationOAuth2PermissionScope.RiskScoreValue}}
Type String The possible values are: User and Admin. Specifies whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator consent should always be required. {{EnterpriseApplicationOAuth2PermissionScope.Type}}
User Consent Description String A description of the delegated permissions, intended to be read by a user granting the permission on their own behalf. This text appears in consent experiences where the user is consenting only on behalf of themselves. {{EnterpriseApplicationOAuth2PermissionScope.UserConsentDescription}}
User Consent Display Name String A title for the permission, intended to be read by a user granting the permission on their own behalf. This text appears in consent experiences where the user is consenting only on behalf of themselves. {{EnterpriseApplicationOAuth2PermissionScope.UserConsentDisplayName}}
Value String Specifies the value to include in the scp (scope) claim in access tokens. {{EnterpriseApplicationOAuth2PermissionScope.Value}}

Relations

Relation Connector Description
Enterprise application Entra ID All registered Enterprise Applications in Entra ID

Segments

This object does currently not have any segments.

Actions

This object does currently not have any actions.

Frequently asked questions

What is the enterprise application OAuth2 permission scope object in Rencore Governance?

All enterprise application OAuth2 permission scopes in Entra ID. Enterprise application OAuth2 permission scope is an object type in the Entra ID inventory of Rencore Governance.

Which properties does Rencore Governance collect for enterprise application OAuth2 permission scope?

Rencore Governance collects 16 properties for Enterprise application OAuth2 permission scope, such as Admin Consent Description, Admin Consent Display Name, App and 13 more.

How often is enterprise application OAuth2 permission scope scanned?

You can change the scan interval of Enterprise application OAuth2 permission scope objects under Configure objects (daily, weekly, bi-weekly, monthly, never or initial (collected once)). The interval is a target, not a guarantee: a scan can run later than planned.

Which module includes the Entra ID connector?

The Entra ID connector is part of the Digital Workplace module of Rencore Governance, which every Plan includes. The connector is generally available.

Related pages

Related pages