Created by Claude - please verify

App management policies - the tenant default policy and custom policies with the apps they apply to.

Required Microsoft Graph permissions

Policy.Read.All Application.Read.All — application permissions, granted to the app registration with admin consent.

Licence: Microsoft Entra Workload ID for enforcing restrictions (reading them needs no licence).

Endpoints: GET /v1.0/policies/defaultAppManagementPolicy · GET /v1.0/policies/appManagementPolicies · GET /v1.0/policies/appManagementPolicies/{id}/appliesTo

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

App Credential Restriction Policies

Client secrets are the credential attackers steal most. App management policies can block new secrets, cap credential lifetimes and restrict identifier URIs tenant-wide - and custom policies can exempt specific apps. App Credential Expiry shows the credentials that exist; this report shows whether new weak ones can be created.