How can I export the API permissions granted to enterprise applications to all the application / app registration

Question

How can I export the API permissions granted to all enterprise applications and app registrations within a tenant, including information about application owners? Additionally, how can these permissions be categorized based on their necessity and priority for remediation, with the goal of removing the highest permissions and applying least privileged permissions? Is there a way to export a complete dump of this data?

Answer 1

There are plenty of free tools available online that do just that, look them up. Here's one of mine, for example: https://www.michev.info/blog/post/5922/reporting-on-entra-id-integrated-applications-service-principals-and-their-permissions

The remediation part is not something that can be easily automated, as there is usually a need for some input - nobody can guess why a particular application needs any given permissions, so you must gather additional evidence as needed. Same goes for least privileged permissions, you need to understand all the calls a given application makes before you can determine whether it complies with the principle of least privilege. The only way to get such data is via the Graph activity audit logs: https://learn.microsoft.com/en-us/graph/microsoft-graph-activity-logs-overview

Answer 2

hello Vasil Michev , thanks for the valuable information and will follow your scripts.