Supporting technical capability
See which third-party apps can already reach your Microsoft 365 email, files, and calendars, ranked by risk.
List the registered applications and their permissions to email, files and calendars. Rank the access risks and recommend which permissions to retain, change or revoke.
Illustrative sample · supporting capability
Who owns the grant, and does the application still need it?
- Observation
- A delegated grant permits data access; its business owner and recent use are unresolved.
- Decision
- Recommend investigation before changing the grant.
- Next action
- Record permission scope, consent type, evidence age and proposed action. Read-only review does not revoke access.
This capability can inform the next service. Its inclusion, price and calendar must be agreed in that service’s scope; following the link does not make it included.
Explore the relevant next serviceTechnical context
When this work applies
- You cannot list which third-party apps can read your email, files, and calendars today.
- If staff can approve apps themselves, one convincing fake only has to be clicked once.
- You need a clear revoke-or-keep call, not a raw export.
Possible outputs
Outputs to agree in scope
Application Consent Risk Review
Each application and consent registered in the tenant, what it is allowed to reach once it is in, a risk rank, and a revoke or keep decision.
High-risk shortlist
The consents to revoke first, with the impact noted.
Consent governance recommendations
How to stop risky consent from happening again.
Commercial & delivery basis
The scope and conditions of the work.
Delivery window
This supporting capability has no separate confirmed delivery window. The proposal names its scope and calendar.
Capability scope to confirm
- Enterprise app and consent inventory
- What each app can reach, ranked by risk
- Revoke or keep decisions
- Consent governance recommendations
Scope assumptions
- One Microsoft Entra ID tenant
Exclusions
- App removal without explicit approval
- Consent policy deployment
Required access
- Read-only Entra ID enterprise apps access
- A 30-minute kickoff with security or IT
Acceptance
The agreed completion standard.
The engagement is complete when the OAuth risk ledger and high-risk shortlist are delivered and walked through.
Discuss the work
Tell us what you need to change.
Share the systems involved, why the change is needed and your deadline. We clarify the work, responsibilities and information needed for a proposal.
Discuss this project