App registration has no unused privileged API permissions

​

What this check verifies

Microsoft Entra OAuth app registrations with privileged API permissions (High privilege level) that are not being actively used. Usage status is determined by Microsoft Defender for Cloud Apps App Governance.

​

Risk

Unused privileged permissions expand the attack surface. If a compromised app has dormant privileged permissions, attackers can exploit them for privilege escalation, unauthorized access to sensitive data, or lateral movement within the environment.

​

Recommendation

Apply the principle of least privilege by regularly reviewing and revoking unused privileged permissions from app registrations. Use Microsoft Defender for Cloud Apps App Governance to monitor permission usage.

​

Remediation

Dashboard steps

1. Navigate to Microsoft Defender XDR portal (https://security.microsoft.com)
2. Go to Cloud apps > App governance > Overview
3. Review the Applications inventory for apps with unused permissions
4. For each flagged app, view details and navigate to the Permissions tab
5. Remove unnecessary permissions via Microsoft Entra admin center

​

References

• https://learn.microsoft.com/en-us/defender-cloud-apps/app-governance-visibility-insights-overview
• https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-oauthappinfo-table

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_app_registration_no_unused_privileged_permissions. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks