Audit Enterprise App Access and Delegated Consent

June 30, 2026 · InfraScout Team

An enterprise application in your tenant is only as safe as three separate answers: what it is allowed to do on its own, who is allowed to use it, and what it can do while acting as your signed-in users. InfraScout already answered the first. With this update it answers the other two. Two new read-only Entra ID tools round out the enterprise application — service principal — assessment picture, so you can ask who has access to an app and what was consented on people's behalf, and get the answer in the same conversation where you run the rest of the review. Both join the Microsoft Cloud — Identity Tools.

The three questions an app audit actually asks

Reviewing an enterprise app is really three questions, and they point in different directions. The first is what permissions does the app itself hold — the application permissions it was granted, like the ability to read mail across the tenant. InfraScout has always been able to read that outgoing view, and it is the right place to catch an over-permissioned app.

But an over-permissioned app is inert until someone can reach it, and its most dangerous capabilities often come not from what it was granted but from what users agreed to let it do. So the audit also has to answer who can use this app and what did it get permission to do as those users. Those are the two directions the previous tooling did not cover, and they are the two this update fills in. Together the three views turn "here is a service principal" into "here is exactly how much of your tenant it can touch, and through whom."

Who can use an app

The first new tool lists everyone assigned to an enterprise application — the users, groups, and other service principals that have been granted access to it. Point InfraScout at an app and it returns the assignees directly, so "who can sign in to this app?" or "which groups were handed access to it?" becomes a single question with a concrete list as the answer.

This is the view you want when an app looks sensitive and you need to scope its blast radius. An app with broad permissions assigned to a handful of named admins is a very different finding from the same app assigned to an all-staff group, and now that distinction is one call away. Because assignments come back as structured results, you can filter them to a single principal type when you only care about, say, which groups carry the access, rather than reading past the individual users to find them.

What was consented on your users' behalf

The second new tool reads an app's delegated permission grants — the OAuth2 consents that let the application act on behalf of signed-in users. This is the other half of "what can this app do," and it is the half that attackers target. Each grant carries a consent type that tells you how far the consent reaches: an administrator can consent once on behalf of everyone in the tenant, or an individual user can consent only for themselves. InfraScout surfaces that distinction, so you can tell org-wide consent apart from a single user clicking through a prompt.

That distinction is the whole point, because delegated consent is the primary surface for illicit-consent and OAuth-phishing attacks. The classic pattern is a malicious or over-eager app that talks a user — or a careless admin — into granting it permission to read mail or files, and then quietly does so with the user's own access. Being able to sweep those grants conversationally turns a tedious, click-through review into a question you can just ask: list every app with org-wide consent to read mail, and who granted it. When something looks wrong, you save it as an insight on the spot, with the specific grant and consent type that justify the finding.

Filter, page, and compose

Both tools behave like the rest of the identity set. They accept the same filtering and field-selection parameters, so you can narrow a result before it ever reaches the model, and they return results a page at a time with a clear pointer to the next page — so a tenant-wide sweep across many apps stays responsive instead of arriving as one overwhelming block.

They are also built to compose. Start by listing the service principals in the tenant, or open a single one to read the permissions it holds, then pivot straight into who is assigned to it and what was consented through it. The same two tools serve a deep dive on one suspicious app and a tenant-wide pass across every enterprise application — you are moving between the three views of the same app, not stitching together separate investigations. Like every mscloud_* tool, both are agentless and read-only: they summarize what your tenant already records and never change a thing in it.

Try it

Open an assessment against a connected tenant and ask the questions directly — "who is assigned to this enterprise app?", "which apps have org-wide consent to read mail, and who granted it?", or "for this service principal, show me the delegated permissions consented on users' behalf." InfraScout picks the right tool, reads from your tenant, and hands back a result you can turn into a finding without leaving the conversation.

Questions or feedback? Reach us at info@infrascout.cloud.