KQL Search

This query is designed to identify OAuth applications that have been active in the last 30 days and have specific permissions related to file access in Microsoft services. Here's a simplified breakdown:

1. Data Source: The query is examining data from the OAuthAppInfo table.

2. Time Filter: It only considers records from the past 30 days (Timestamp > ago(30d)).

3. App Status: It filters for applications that are currently "Enabled".

4. Permissions Expansion: The query expands the list of permissions for each application to examine them individually.

5. Target Application: It specifically looks for permissions associated with 'Microsoft Graph'.

6. Specific Permissions: The query checks for applications that have any of the following permissions:

   • MyFiles.Write: Permission to write to the user's files.
   • Files.ReadWrite.All: Permission to read and write all files the user can access.
   • Sites.ReadWrite.All: Permission to read and write all SharePoint sites the user can access.
   • AllSites.Write: Permission to write to all sites.

The overall goal is to identify potentially risky applications with broad access to files and sites, which could be a security concern.