Created by Claude - please verify

Application permissions - tiers come from a fixed list of permission names; review each app with its owner before removing anything.

Required Microsoft Graph permissions

Application.Read.All AuditLog.Read.All — application permissions, granted to the app registration with admin consent.

Endpoints: GET /v1.0/servicePrincipals(appId=...)?$select=appRoles · GET /v1.0/servicePrincipals/{resource}/appRoleAssignedTo (Graph, Exchange Online, SharePoint Online) · GET /beta/reports/servicePrincipalSignInActivities

Tiers: 'Tenant takeover' = can escalate its own or others' rights; 'All data' = reads/writes every mailbox, file, site or chat; 'Write' = any other write permission. Last sign-in needs Entra ID P1.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Apps with High-privilege Application Permissions

Application permissions work without a signed-in user and ignore Conditional Access. An app with Mail.Read can read every mailbox; one with RoleManagement.ReadWrite.Directory or AppRoleAssignment.ReadWrite.All can make itself Global Administrator. This is the counterpart to the OAuth Consent Grants report, which covers delegated permissions.

No app holds application permissions on Microsoft Graph, Exchange Online or SharePoint Online.