How to find the third-party apps with access to your Microsoft 365
To find every third-party app with access to your Microsoft 365, open the Microsoft Entra admin center and go to Identity → Applications → Enterprise applications. That list is your complete inventory of connected apps; each one’s Permissions blade shows what it can reach — mail, files, or the directory — and whether an administrator granted it for the whole organization. The rest of this guide is how to tell the dangerous grants from the harmless ones.
Delegated vs. application permissions
On each app’s Permissions blade, the distinction that matters is delegated permissions (the app acts as a signed-in user) versus application permissions (the app acts on its own, often across the whole tenant). Application permissions are the ones to watch — they don’t need a user present. The Microsoft 365 admin center’s Integrated apps page shows a friendlier subset, but Entra is where the complete picture lives.
What to look for
- Application permissions to everything. An app with Mail.Read, Files.ReadWrite.All, or Directory.ReadWrite.All as an application permission can reach every mailbox, file, or object in the tenant — no user needed.
- Org-wide admin consent. A grant an admin approved for the entire organization is far riskier than one a single user consented to for themselves.
- Unverified publishers. Apps whose publisher Microsoft hasn’t verified (no blue “verified” badge) deserve extra scrutiny.
- Apps holding credentials. Service principals with client secrets or certificates can authenticate silently; a leaked secret is a standing back door.
- Stale grants. Consent doesn’t expire. An app nobody has used in a year keeps its access until someone revokes it.
The catch with doing it manually
Entra shows you the apps, but it doesn’t rank them. A mid-sized tenant can have hundreds of service principals, each with a mix of delegated and application permissions granted by different people at different times. Working out which grants actually matter — cross-referencing permission risk, consent type, publisher status, and whether the app is still in use — is the hard part, and the one dangerous grant is easy to miss.
A faster path
This is exactly what Esmeris automates: a read-only audit that inventories every enterprise app, OAuth grant, and permission in your tenant and ranks them by real-world risk, then hands you a graded report in plain English. See the sample report for what that looks like.