azureblog.co.uk
← cd ~/tools
// tools/app-risk

App permission risk check

Find the apps in your tenant that can read every mailbox, change directory roles or write to every SharePoint site. Run the read-only script, load its output here, and each app is ranked by the riskiest permission it holds.

Runs entirely in your browser. Nothing you paste is sent anywhere.

  1. Download the script. Get-AzureBlogAppPermissions.ps1 It reads service principals, their application permissions (app roles) and delegated permission grants, including ones users consented to themselves. It changes nothing.
  2. Run it as a Global Reader or Application Administrator:
    powershell2 lines
    Install-Module Microsoft.Graph.Authentication -Scope CurrentUser   # first time only
.\Get-AzureBlogAppPermissions.ps1
  3. Load the result here. It saves azureblog-app-permissions-<date>.json. The file holds app names and permission names only. It's read in your browser and never uploaded.

Drop your azureblog-app-permissions-….json file here

Risk ratings are this site's guidance, based on what each permission allows as described in Microsoft's Graph permissions reference. Look up any permission in the Graph permission explainer.