Created by Claude - please verify

Unused delegated consents - service principal sign-in activity comes from a beta Graph report.

Required Microsoft Graph permissions

Directory.Read.All Application.Read.All AuditLog.Read.All — application permissions, granted to the app registration with admin consent.

Licence: Microsoft Entra ID P1 (service principal sign-in activity).

Endpoints: GET /v1.0/oauth2PermissionGrants · GET /v1.0/servicePrincipals · GET /beta/reports/servicePrincipalSignInActivities

'No delegated sign-in recorded' also covers apps idle since Microsoft started collecting this data. Rows with high-impact scopes (mail, files, directory write) are listed first.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Unused Delegated Consents

Apps that users (or an admin, for everyone) granted access to their data, but that have not signed in on anyone's behalf for 90 days. The permission is still live: revoking it removes the risk without affecting anyone.

Every app holding delegated consent signed in on a user's behalf within the last 90 days.