Created by Claude - please verify

App registration hygiene - owner lists come from $expand, which returns at most 20 owners per app.

Required Microsoft Graph permissions

Application.Read.All — application permission, granted to the app registration with admin consent.

Endpoint: GET /v1.0/applications?$expand=owners

Covers app registrations owned by this tenant only; third-party apps appear in the service-principal reports. 'Valid credentials' comes from the App Credential Expiry data.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

App Registration Hygiene

App registrations built in this tenant: which have nobody accountable for them, which send tokens to wildcard or unencrypted redirect URIs (token theft), and which accept sign-ins from any tenant without a verified publisher.

This tenant has no app registrations.