OAuth2 permission scope

Last updated Oct 17, 2026 Inventory

AI summary

OAuth2 permission scopes in Entra ID are tracked as part of your identity inventory. Each scope includes properties such as consent descriptions, activation status, and risk scores to help you monitor delegated permissions. You can configure automatic scanning at daily, weekly, or monthly intervals to keep your inventory current.

All OAuth permission scopes in Entra ID

Part of the Entra ID inventory.

Scan settings

Default scanning interval	Allowed scanning intervals	Data removal during incremental scan
Default	Daily, Weekly, Bi-Weekly, Monthly, Never, Initial	Yes

Properties

Property	Type	Description	Automation placeholder
Admin Consent Description	String	A description of the delegated permissions, intended to be read by an administrator granting the permission on behalf of all users. This text appears in tenant-wide admin consent experiences.	`{{OAuth2PermissionScope.AdminConsentDescription}}`
Admin Consent Display Name	String	The permission's title, intended to be read by an administrator granting the permission on behalf of all users.	`{{OAuth2PermissionScope.AdminConsentDisplayName}}`
App	Enterprise application	The unique identifier for the application.	`{{OAuth2PermissionScope.App}}`
App Name	String	The display name exposed by the associated application.	`{{OAuth2PermissionScope.AppName}}`
Initially Scanned	DateTime	Shows when this object was initially found in a scan.	`{{OAuth2PermissionScope.CreatedTime}}`
Display Name	String		`{{OAuth2PermissionScope.DisplayName}}`
Is Enabled	Boolean	When creating or updating a permission, this property must be set to true (which is the default). To delete a permission, this property must first be set to false. At that point, in a subsequent call, the permission may be removed.	`{{OAuth2PermissionScope.IsEnabled}}`
Last scan update	DateTime	Shows when this object was last updated in a scan. If an object is found during a scan but no property has been changed this date will not change.	`{{OAuth2PermissionScope.LastModifiedTime}}`
Id	String	Unique delegated permission identifier inside the collection of delegated permissions defined for a resource application.	`{{OAuth2PermissionScope.OAuth2PermissionScopeId}}`
Risk Score	Int32	Stores risk score	`{{OAuth2PermissionScope.RiskScore}}`
Risk Score Update	DateTime	Stores risk score update	`{{OAuth2PermissionScope.RiskScoreLastUpdate}}`
Risk Score Value	String	Stores risk score value like Low_Low	`{{OAuth2PermissionScope.RiskScoreValue}}`
Type	String	The possible values are: User and Admin. Specifies whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator consent should always be required.	`{{OAuth2PermissionScope.Type}}`
User Consent Description	String	A description of the delegated permissions, intended to be read by a user granting the permission on their own behalf. This text appears in consent experiences where the user is consenting only on behalf of themselves.	`{{OAuth2PermissionScope.UserConsentDescription}}`
User Consent Display Name	String	A title for the permission, intended to be read by a user granting the permission on their own behalf. This text appears in consent experiences where the user is consenting only on behalf of themselves.	`{{OAuth2PermissionScope.UserConsentDisplayName}}`
Value	String	Specifies the value to include in the scp (scope) claim in access tokens.	`{{OAuth2PermissionScope.Value}}`

Relations

Relation	Connector	Description
Enterprise application	Entra ID	All registered Enterprise Applications in Entra ID

Segments

This object does currently not have any segments.

Actions

This object does currently not have any actions.

Frequently asked questions

What is the OAuth2 permission scope object in Rencore Governance?

All OAuth permission scopes in Entra ID. OAuth2 permission scope is an object type in the Entra ID inventory of Rencore Governance.

Which properties does Rencore Governance collect for OAuth2 permission scope?

Rencore Governance collects 16 properties for OAuth2 permission scope, such as Admin Consent Description, Admin Consent Display Name, App and 13 more.

How often is OAuth2 permission scope scanned?

You can change the scan interval of OAuth2 permission scope objects under Configure objects (daily, weekly, bi-weekly, monthly, never or initial (collected once)). The interval is a target, not a guarantee: a scan can run later than planned.

Which module includes the Entra ID connector?

The Entra ID connector is part of the Digital Workplace module of Rencore Governance, which every Plan includes. The connector is generally available.

Was this page helpful?