New Graph permissions make app reviews a recurring job
Reviewed by Helen Jones
Office365ITPros published a PowerShell pattern that compares a saved baseline of Microsoft Graph application permissions and delegated scopes with the current Microsoft Graph service principal. A 29 August run found 13 new permissions for granular user-authentication-method management, then reported the difference for an administrator to assess.
App permissions are often granted during a project and then left alone while Microsoft adds more specific alternatives. That can leave a tenant carrying broad consent simply because nobody has a repeatable way to notice the change. A difference report is not an automatic permission downgrade. A narrower permission can expose a hidden dependency, such as a property the app needs to filter on, so the useful control is a regular review followed by a non-production test and an owner decision.
Analysis
Set a monthly or quarterly Graph-permission comparison, send differences to each app owner, and test any proposed least-privilege replacement in a non-production tenant before changing production consent.
Source note
Pulse published by Collab365 Spaces, reviewed by Helen Jones on . Cite as "New Graph permissions make app reviews a recurring job", Collab365 Spaces.