OAuth2 permission grant

Last updated Oct 17, 2026 Inventory

AI summary

Rencore scans OAuth2 permission grants in Entra ID to identify which applications are authorized to access APIs on behalf of users. For each grant, you can view properties like the client application, the resource being accessed, delegated permissions (scopes), and whether authorization applies to all users or specific ones. The system includes risk scoring to help you identify potentially risky permission grants.

All OAuth permission grants in Entra ID

Part of the Entra ID inventory.

Scan settings

Default scanning interval	Allowed scanning intervals	Data removal during incremental scan
Default	Daily, Weekly, Bi-Weekly, Monthly, Never, Initial	Yes

Properties

Property	Type	Description	Automation placeholder
Client	String	The id of the client service principal for the application which is authorized to act on behalf of a signed-in user when accessing an API.	`{{OAuth2PermissionGrant.Client}}`
Client Id	String	he id of the client service principal for the application which is authorized to act on behalf of a signed-in user when accessing an API.	`{{OAuth2PermissionGrant.ClientId}}`
Client Name	String		`{{OAuth2PermissionGrant.ClientName}}`
Consent Type	String	Indicates if authorization is granted for the client application to impersonate all users or only a specific user. AllPrincipals indicates authorization to impersonate all users. Principal indicates authorization to impersonate a specific user.	`{{OAuth2PermissionGrant.ConsentType}}`
Initially Scanned	DateTime	Shows when this object was initially found in a scan.	`{{OAuth2PermissionGrant.CreatedTime}}`
Display Name	String		`{{OAuth2PermissionGrant.DisplayName}}`
Last scan update	DateTime	Shows when this object was last updated in a scan. If an object is found during a scan but no property has been changed this date will not change.	`{{OAuth2PermissionGrant.LastModifiedTime}}`
Id	String	Unique identifier for the oAuth2PermissionGrant.	`{{OAuth2PermissionGrant.OAuth2PermissionGrantId}}`
Principal	User	The id of the user on behalf of whom the client is authorized to access the resource, when consentType is Principal. If consentType is AllPrincipals this value is null.	`{{OAuth2PermissionGrant.Principal}}`
Principal Name	String	The name displayed in the address book for the user. This is usually the combination of the user's first name, middle initial and last name.	`{{OAuth2PermissionGrant.PrincipalName}}`
Resource	String		`{{OAuth2PermissionGrant.Resource}}`
Resource Id	String	The id of the resource service principal to which access is authorized. This identifies the API which the client is authorized to attempt to call on behalf of a signed-in user.	`{{OAuth2PermissionGrant.ResourceId}}`
Resource Name	String		`{{OAuth2PermissionGrant.ResourceName}}`
Risk Score	Int32	Stores risk score	`{{OAuth2PermissionGrant.RiskScore}}`
Risk Score Update	DateTime	Stores risk score update	`{{OAuth2PermissionGrant.RiskScoreLastUpdate}}`
Risk Score Value	String	Stores risk score value like Low_Low	`{{OAuth2PermissionGrant.RiskScoreValue}}`
Scope	String	A space-separated list of the claim values for delegated permissions which should be included in access tokens for the resource application (the API). For example, openid User.Read GroupMember.Read.All. Each claim value should match the value field of one of the delegated permissions defined by the API, listed in the oauth2PermissionScopes property of the resource service principal.	`{{OAuth2PermissionGrant.Scope}}`

Relations

Relation	Connector	Description
Enterprise application	Entra ID
Enterprise application	Entra ID
User	Microsoft 365	All users registered in your tenant (internal, external)

Segments

This object does currently not have any segments.

Actions

This object does currently not have any actions.

Frequently asked questions

What is the OAuth2 permission grant object in Rencore Governance?

All OAuth permission grants in Entra ID. OAuth2 permission grant is an object type in the Entra ID inventory of Rencore Governance.

Which properties does Rencore Governance collect for OAuth2 permission grant?

Rencore Governance collects 17 properties for OAuth2 permission grant, such as Client, Client Id, Client Name and 14 more.

How often is OAuth2 permission grant scanned?

You can change the scan interval of OAuth2 permission grant objects under Configure objects (daily, weekly, bi-weekly, monthly, never or initial (collected once)). The interval is a target, not a guarantee: a scan can run later than planned.

Which module includes the Entra ID connector?

The Entra ID connector is part of the Digital Workplace module of Rencore Governance, which every Plan includes. The connector is generally available.

Was this page helpful?