Review high-risk API permissions granted to applications

Description

Application permissions (app roles) and tenant-wide delegated grants on high-risk APIs are reviewed at least every 90 days. High-risk permissions include at least:

• permissions that lead to tenant control: RoleManagement.ReadWrite.Directory, AppRoleAssignment.ReadWrite.All, Application.ReadWrite.All, Directory.ReadWrite.All, Policy.ReadWrite.*, UserAuthenticationMethod.ReadWrite.All, Group.ReadWrite.All, ServicePrincipalEndpoint.ReadWrite.All;
• permissions that read or change all mailboxes, files or chats: Mail.*, Files.*, Sites.*, Chat.*, full_access_as_app, EWS.AccessAsUser.All.

Each such permission has an owner and a justification, is still used, and is scoped where the service allows it (for example Exchange RBAC for Applications, Sites.Selected).

Rationale

An application permission works without a user and without Conditional Access for users: whoever holds the credential acts on the whole tenant. Permissions that allow granting roles or other permissions give a direct or indirect path to Global Administrator, and were the escalation path in several public cloud intrusions. Unused privileged permissions add risk without value.

Impact

Removing a permission that is still used breaks the integration. Check service principal sign-ins and the application's API activity before revoking.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Enterprise apps > All applications, filter on Application type = Enterprise applications, open each application and check Permissions (admin consent tab) for the permissions above.
3. In Microsoft Graph PowerShell (scopes Application.Read.All, Directory.Read.All), list application permissions per service principal with Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId <id> and tenant-wide delegated grants with Get-MgOauth2PermissionGrant -All | Where-Object ConsentType -eq 'AllPrincipals'.
4. If Microsoft Defender for Cloud Apps app governance is licensed, use Microsoft Defender portal > Cloud apps > App governance > Applications to filter on high-privilege and unused permissions.
5. Fail if a high-risk permission has no documented owner and justification, has not been used for 90 days, or is granted tenant-wide where a scoped alternative exists.

Remediation

1. For each finding, contact the application owner and confirm the need.
2. Remove unneeded permissions: Enterprise apps > the application > Permissions > Review permissions, or in Graph PowerShell Remove-MgServicePrincipalAppRoleAssignment and Remove-MgOauth2PermissionGrant. Role required: Privileged Role Administrator (Cloud Application Administrator cannot revoke Microsoft Graph app roles).
3. Replace broad permissions with scoped ones: Sites.Selected, Exchange Online RBAC for Applications, administrative units.
4. Record owner, justification and review date for the permissions that remain.

Rollback

Grant the removed permission again with admin consent if an integration breaks.

References

• Review permissions granted to enterprise applications Microsoft, vendor-doc, accessed 2026-10-24
• Manage app governance in Microsoft Defender for Cloud Apps Microsoft, vendor-doc, accessed 2026-10-24
• Maester test catalogue (MT.1050, MT.1051, MT.1079) Maester, tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-APPS-002 Restrict user consent to applications
• related CB-M365-APPS-012 Restrict and protect owners of privileged applications
• related CB-M365-AUDIT-011 Connect Microsoft Defender for Cloud Apps to Microsoft 365 and enable its policies
• related CB-M365-MAIL-037 Scope application access to mailboxes with RBAC for Applications

People and lifecycle