How to Audit Entra ID Application Operations in Microsoft 365

When a Microsoft 365 user signs in to an Azure AD application, the application may request permissions that govern its access to resources. These permission grants fall into two types: user consent and admin consent:

• Go to Enterprise applications»All applications»Select the Respective application in Entra portal.
• Click on Permissions to see a list of permissions granted for your organization.
• Move to the ellipsis associated with the desired permission and hit Revoke Permission.

While the Entra admin center allows for the revocation of admin grants, it does not provide a method to revoke individual user consents directly from the Azure AD application. To revoke all permissions of a user across all service principals, use the following cmdlet in MS Graph PowerShell, specifying the user's ObjectID.

Connect-MgGraph -Scopes "DelegatedPermissionGrant.ReadWrite.All"
$Id = (Get-MgBetaOauth2PermissionGrant -Filter "principalId eq '<UserObjectID>'").Id
Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId $Id

Replace <UserObjectID> with the actual object ID of the user.

Note: To prevent illicit grant consent attacks within the Microsoft 365, where a malicious actor creates an Azure-registered application to request permissions, block user consent for applications in Microsoft 365.

• The Consent to Applications Report simplifies tracking consents across your organization by clearly showing both admin and user permissions granted to each application, all consolidated together.

Tip: Since attackers steal the sensitive data using different patterns, you should always ensure to follow the essential steps to configure and manage app permissions in Microsoft 365.

A Service Principal in Microsoft 365 is a security identity that an application or service uses to access specific resources. Think of it as an account that the application uses to authenticate and access resources, authorize and delegate permissions securely.

When you register an app in Azure AD, it creates an application object as a global representation. To access resources in a tenant, however, a service principal object is created within that tenant. To know exactly what the service principal is, you must know the difference between the 'App Registration' and 'Enterprise Applications'.

• Navigate to the Audit section in the M365 Purview portal
• Choose all the activities related to service principals under 'Activities-friendly names' and click Search.
• Wait for some time for the search to be completed and click on the respective audit search to see the service principal changes.

• The Service Principal Changes Report tracks all changes to service principals, including who performed those actions and on which enterprise applications.
• The 'Result Status' column helps quickly identify whether the operation is successful or failed, it aids in efficient troubleshooting.

Pro Tip: Utilize the Schedule option to receive the service principal changes report periodically to your mailbox.

By keeping track of application deletions in Microsoft 365, admins can respond to potential security breaches and ensure that critical applications are not removed without proper authorization. This proactive approach helps safeguard the integrity of the IT environment and supports the organization's overall security posture.

Microsoft Entra offers a recycle bin functionality for certain deleted objects, including applications. To ensure that you can track deleted applications in Microsoft 365 effectively, follow these steps:

• In Microsoft Entra admin center, navigate to Identity»Application»App registrations.
• Switch to the 'Deleted applications' tab to get all Azure AD applications deleted within the last 30 days.

Run the below PowerShell cmdlet to retrieve a list of all deleted applications in Azure AD.

Connect-MgGraph -Scopes "AuditLog.Read.All"
Get-MgAuditLogDirectoryAudit -Filter "activityDisplayName eq 'Delete application'" | Format-Table userPrincipalName, activityDisplayName, activityDateTime, targetResources

• The Deleted Applications report provides a detailed audit of all application deletions within Microsoft 365, including who deleted the apps and the exact time of deletion.
• This helps admins track and review removed applications to ensure no unauthorized or accidental deletions occur.

Tip: Set up AdminDroid alerts for this report to receive immediate notifications about deleted applications in your organization.