How to find the third-party apps with access to your Microsoft 365
To find every third-party app with access to your Microsoft 365, open the Microsoft Entra admin center and go to Identity → Applications → Enterprise applications. That list is your complete inventory of connected apps. Each one’s Permissions blade shows what it can reach (mail, files, or the directory) and whether an administrator granted it for the whole organization. The rest of this guide is how to pick out the grants that need attention.
Delegated vs. application permissions
On each app’s Permissions blade, the distinction that matters is delegated permissions (the app acts as a signed-in user) versus application permissions (the app acts on its own, often across the whole tenant). Application permissions are the ones to watch: no user needs to be present. The Microsoft 365 admin center’s Integrated apps page shows a friendlier subset, but Entra is where the complete picture lives.
What to look for
- Application permissions to everything. An app with Mail.Read, Files.ReadWrite.All, or Directory.ReadWrite.All as an application permission can reach every mailbox, file, or object in the tenant, with no user needed.
- Org-wide admin consent. A grant an admin approved for the entire organization is far riskier than one a single user consented to for themselves.
- Unverified publishers. Apps whose publisher Microsoft hasn’t verified (no blue “verified” badge) deserve extra scrutiny.
- Apps holding credentials. Service principals with client secrets or certificates can authenticate silently; a leaked secret is a standing back door.
- Stale grants. Consent doesn’t expire. An app nobody has used in a year keeps its access until someone revokes it.
The catch with doing it manually
Entra shows you the apps, but it doesn’t rank them. A mid-sized tenant can have hundreds of service principals, each with a mix of delegated and application permissions granted by different people at different times. Working out which grants matter means cross-referencing permission risk, consent type, publisher status, and whether the app is still in use. One dangerous grant is easy to miss.
A faster path
An Esmeris audit does the ranking for you. It reads your tenant with read-only access, inventories every enterprise app and grant, and turns the result into a graded report in plain English.