Created by Claude - please verify

App ownership - owners of apps that hold high-privilege application permissions or directory roles, compared with who holds admin roles.

Required Microsoft Graph permissions

Application.Read.All RoleManagement.Read.Directory — application permissions, granted to the app registration with admin consent.

Licence: None.

Endpoints: GET /v1.0/servicePrincipals/{resource}/appRoleAssignedTo (cached) · GET /v1.0/roleManagement/directory/roleAssignments (cached) · GET /v1.0/servicePrincipals/{id}/owners ($batch) · GET /v1.0/applications?$expand=owners (cached)

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Privilege Escalation through App Ownership

Whoever owns an app registration or enterprise app can add a client secret and sign in as the app. If the app holds Directory.ReadWrite.All, Mail.Read or a directory role, a regular user who owns it effectively holds that access too. Guest owners are covered by Guests with Elevated Access; this report covers member owners.