Created by Claude - please verify

Enterprise apps with 'Assignment required' off - non-Microsoft service principals only.

Required Microsoft Graph permissions

Application.Read.All Directory.Read.All (delegated consents) — application permissions, granted to the app registration with admin consent.

Licence: None.

Endpoints: GET /v1.0/servicePrincipals?$select=appRoleAssignmentRequired,preferredSingleSignOnMode,... · GET /v1.0/oauth2PermissionGrants (cached)

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Enterprise Apps Open to Every User

When Assignment required is off, every user in the tenant - and every guest - can sign in to the app and get a token for it. For SSO apps and apps with delegated access to mail or files that is rarely intended.