Enterprise applications that use SharePoint Online permissions
AI summary
Enterprise applications with broad SharePoint Online permissions like Sites.FullControl.All can access every site in your tenant. Verify each has an owner and business reason, then narrow permissions to only the sites where it is needed.
What it detects
Shows Enterprise applicationsEnterprise applicationAn enterprise application is the local instance of an app in a Microsoft Entra tenant, its service principal, where admins control who can sign in and which permissions it holds.Read more that use SharePoint Online permissions.
Why it matters
Apps with SharePoint Online permissions can read or change site content, and with an application permissionApplication and delegated permissionsApplication and delegated permissions are the two kinds of Microsoft permissions Rencore Governance asks for.Read more such as Sites.FullControl.All they reach every site in the tenant without a signed-in user. This policy is an inventory, not an alarm: it shows which apps have that reach. Check that each one has an owner and a business reason, and narrow broad permissions to Sites.Selected where the app only needs a few sites.
The rule
Every Enterprise Application that has any App Role Assignment Service Principals where Display Name contains 'Office 365 SharePoint Online'
In Rencore Governance
Details
| Applies to | Enterprise application |
|---|---|
| Connector | Entra ID |
| Severity | Information |
| Category | Security |
| Recommended | No |
| Recommended automation | None |
| License type | Standard |
Related policies
Other policies that check Enterprise application objects:
- Enterprise applications using Exchange Web Services (EWS) (High)
- Enterprise applications with full control or write permissions (Medium)
- Enterprise applications without owners (Medium)
- Enterprise applications (SharePoint add-ins) with certificates or client secrets (Medium)
- Enterprise applications that use Microsoft Graph permissions (Information)
- Enterprise applications (SharePoint add-ins) with expired certificates or client secrets (Medium)
Frequently asked questions
What does the enterprise applications that use SharePoint Online permissions policy detect?
What does the enterprise applications that use SharePoint Online permissions policy detect?The Enterprise applications that use SharePoint Online permissions policy shows Enterprise applications that use SharePoint Online permissions. The Enterprise applications that use SharePoint Online permissions policy checks Enterprise application objects from the Entra ID inventory and reports each match as a violation.
How severe is a violation of the enterprise applications that use SharePoint Online permissions policy?
How severe is a violation of the enterprise applications that use SharePoint Online permissions policy?Violations of the Enterprise applications that use SharePoint Online permissions policy have Information severity. The policy is in the Security category.
Which module includes the enterprise applications that use SharePoint Online permissions policy?
Which module includes the enterprise applications that use SharePoint Online permissions policy?The Enterprise applications that use SharePoint Online permissions policy comes with the Entra ID connector in the Digital Workplace module of Rencore Governance, which every Plan includes.
Was this page helpful?
Thanks for the feedback.
Thanks. What was wrong?