Enterprise applications that use Microsoft Graph permissions
AI summary
Review Enterprise Applications using Microsoft Graph permissions, which can access Microsoft 365 data without a signed-in user. Verify each app has an owner and still needs its assigned permissions.
What it detects
Shows Entra ID appsApp registrationAn app registration is the global definition of an application in Microsoft Entra ID.Read more that use Microsoft GraphMicrosoft GraphMicrosoft Graph is the Microsoft API that gives access to the data of the Microsoft 365 services.Read more permissions.
Why it matters
Microsoft Graph is the API to almost all Microsoft 365Microsoft 365Microsoft 365 is the Microsoft cloud suite of Teams, SharePoint, OneDrive, Exchange and the Office apps.Read more data: mail, files, TeamsMicrosoft TeamsMicrosoft Teams is the Microsoft 365 app for chat, meetings and team collaboration.Read more messages and users. An app with Graph application permissionsApplication and delegated permissionsApplication and delegated permissions are the two kinds of Microsoft permissions Rencore Governance asks for.Read more works without a signed-in user, so its reach depends only on what an admin granted. This policy is an inventory: review it regularly and check that each app has an owner, is still in use and needs every permission it has.
The rule
Every Enterprise Application that has any App Role Assignment Service Principals where Display Name contains 'Microsoft Graph'
In Rencore Governance
Details
| Applies to | Enterprise application |
|---|---|
| Connector | Entra ID |
| Severity | Information |
| Category | Security |
| Recommended | No |
| Recommended automation | None |
| License type | Standard |
Related policies
Other policies that check Enterprise application objects:
- Enterprise applications using Exchange Web Services (EWS) (High)
- Enterprise applications that use SharePoint Online permissions (Information)
- Enterprise applications with full control or write permissions (Medium)
- Enterprise applications without owners (Medium)
- Enterprise applications (SharePoint add-ins) with certificates or client secrets (Medium)
- Enterprise applications (SharePoint add-ins) with expired certificates or client secrets (Medium)
Frequently asked questions
What does the enterprise applications that use Microsoft Graph permissions policy detect?
The Enterprise applications that use Microsoft Graph permissions policy shows Entra ID apps that use Microsoft Graph permissions.
Which objects does the enterprise applications that use Microsoft Graph permissions policy check?
The Enterprise applications that use Microsoft Graph permissions policy checks Enterprise application objects from the Entra ID inventory and reports each one that matches its rule as a violation.
How severe is a violation of the enterprise applications that use Microsoft Graph permissions policy?
Violations of the Enterprise applications that use Microsoft Graph permissions policy have Information severity. The policy is in the Security category.
Which module includes the enterprise applications that use Microsoft Graph permissions policy?
The Enterprise applications that use Microsoft Graph permissions policy comes with the Entra ID connector in the Digital Workplace module of Rencore Governance, which every Plan includes.
Was this page helpful?
Thanks for the feedback.
Thanks. What was wrong?