Created by Claude - please verify

Inactive enterprise apps - sign-in activity comes from a beta Graph report; confirm with the app owner before deleting anything.

Required Microsoft Graph permissions

Application.Read.All AuditLog.Read.All — application permissions, granted to the app registration with admin consent.

Licence: Microsoft Entra ID P1 for service principal sign-in activity.

Endpoints: GET /v1.0/servicePrincipals · GET /beta/reports/servicePrincipalSignInActivities · GET /v1.0/applications + /servicePrincipals (credentials, shared with App Credential Expiry)

Microsoft first-party apps and managed identities are left out. 'No sign-in recorded' can also mean the app has not signed in since Microsoft started collecting this data.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Inactive Enterprise Apps & Stale Service Principals

Apps that nobody signs in to any more but that still hold permissions - and often a valid secret or certificate - are free persistence for an attacker. Apps with active credentials and no recent sign-in are listed first.

This tenant has no enterprise apps other than Microsoft's own.