Overprivileged Admin Consented O Auth Applications
Query
// Following the principle of least privilege, have you reviewed the permissions granted to your admin-consented OAuth applications? It’s important to identify applications with permissions that are no longer utilized after being consented. Use the KQL query below to audit and analyze the overprivileged permissions assigned to these applications.
OAuthAppInfo
| mv-expand Permissions
| where Permissions.InUse == false
| where IsAdminConsented == 1
| where AppStatus == "Enabled"
| summarize UnUsedPermission=count() by AppName,
tostring(Permissions.TargetAppDisplayName),
tostring(Permissions.PermissionValue)Explanation
This KQL query is designed to help you audit and analyze OAuth applications that have been granted admin consent but have permissions that are no longer being used. Here's a simple breakdown of what the query does:
-
Data Source: It starts by accessing a dataset called
OAuthAppInfo, which contains information about OAuth applications and their permissions. -
Expand Permissions: It uses
mv-expandto break out the permissions associated with each application into individual rows, making it easier to analyze each permission separately. -
Filter Unused Permissions: The query filters out permissions that are not currently in use (
Permissions.InUse == false). -
Filter Admin Consented Apps: It further narrows down the results to only include applications that have been granted admin consent (
IsAdminConsented == 1). -
Filter Enabled Apps: It only considers applications that are currently enabled (
AppStatus == "Enabled"). -
Summarize Results: Finally, it summarizes the data by counting the number of unused permissions for each application. The results are grouped by the application name, the display name of the target application for the permission, and the specific permission value.
In essence, this query helps identify enabled OAuth applications with admin consent that have permissions which are no longer being utilized, allowing you to potentially reduce overprivileged access.
Details
Steven Lim
Released: April 15, 2025
Tables
Keywords
Operators