IAM · Microsoft Graph permission governance

OAuth scope sprawl, Conditional Access
coverage gaps.

30 synthetic Microsoft Graph-consented apps across MS 1P, ISV Tier 1, mid-market, and in-house · 6 detected anomaly patterns · Conditional Access coverage matrix · ed25519-signed hash-chained audit. Buyer-facing operator surface, browser-only, no live data.

30Total apps consentedsynthetic Continental Banking tenant
11App-only authorizationsnon-user, no MFA
2Over-permissioned appsscope >> use
12High-risk scopes in useFullControl / .All

App registry — Continental Banking tenant

30 synthetic Entra-registered apps across MS 1P, ISV Tier 1, mid-market SaaS, and in-house custom classifications. 7 are over-permissioned, unused, or have scope-creep, secret-expiry, or CA-policy coverage gaps. Auth type distinguishes app-only (non-user, no MFA — narrower trust boundary required) from delegated (user-context, falls under standard CA policies).

AppClassAuthHighest-risk scopeTotal scopesConsentedStatus
SharePoint OnlineMS 1PApp-only + DelegatedSites.FullControl.All222024-08-14Current
Microsoft TeamsMS 1PDelegatedUser.Read.All182024-08-14Scope creep
OneDrive for BusinessMS 1PDelegatedFiles.ReadWrite.All142024-08-14Current
Exchange OnlineMS 1PApp-onlyMail.ReadWrite92024-08-14Current
Power BI ServiceMS 1PDelegatedDataset.Read.All82024-08-14Current
Power AutomateMS 1PDelegatedMail.Send112024-08-14Current
Azure DevOpsMS 1PDelegatedUser.Read42024-08-14Current
Defender for Cloud AppsMS 1PApp-onlyAuditLog.Read.All62024-08-14Current
Salesforce (Cloud Sync)ISV Tier 1DelegatedMail.Send + Calendars.Read72025-01-22Current
Slack Enterprise GridISV Tier 1App-onlyFiles.Read.All52025-02-08Over-permissioned
Atlassian Cloud (Jira+Conf)ISV Tier 1DelegatedUser.Read32025-03-12Current
ServiceNowISV Tier 1App-only + DelegatedMail.Send + Sites.Read.All62025-02-19Current
Datadog (M365 Audit Ingest)ISV Tier 1App-onlyAuditLog.Read.All42025-05-30Secret expiring
Splunk (O365 Audit Connector)ISV Tier 1App-onlyAuditLog.Read.All42025-04-08Current
Workday (Outlook Sync)ISV Tier 1DelegatedCalendars.ReadWrite52025-01-15Current
Zoom (Calendar Bot)ISV Tier 1DelegatedCalendars.ReadWrite32024-12-04Current
Box (Files Sync)ISV Tier 1DelegatedFiles.ReadWrite.All42025-02-22Current
DocuSign (Envelope Integration)ISV Tier 1DelegatedMail.Send + Files.ReadWrite.All52025-03-30Current
CalendlyMid-marketDelegatedCalendars.Read22025-04-19Current
LoomMid-marketDelegatedCalendars.Read22024-11-08Unused 134d
NotionMid-marketDelegatedUser.Read22025-05-02Current
LatticeMid-marketDelegatedUser.ReadBasic.All32025-03-18Current
LucidchartMid-marketDelegatedUser.Read22024-12-12Unused 110d
PagerDutyMid-marketApp-onlyMail.Send22024-09-22No CA policy
GreenhouseMid-marketDelegatedMail.Send + Calendars.ReadWrite42025-02-04Current
GongMid-marketDelegatedCalendars.Read22025-05-28Current
ContinentalDataPortal (Custom)In-houseApp-onlySites.FullControl.All82025-05-29OVER-PERM CRIT
CB-Trust-Audit-WorkerIn-houseApp-onlyAuditLog.Read.All32025-04-12Current
ContractsAI-PilotIn-houseApp-onlyFiles.ReadWrite.All52025-05-15No CA policy
SalesIntelExtractorIn-houseDelegatedUser.Read.All + Mail.Read62025-05-22Scope creep

Anomaly detector — 6 patterns surfaced

Patterns matched across all 30 apps: over-permissioned in-house custom apps, over-permissioned ISVs without DLP, unused-90d dormants, silent scope creep, secret-expiry without alert, Conditional Access coverage gaps. Each anomaly carries a specific regulatory anchor.

Over-permissioned — in-house custom

ContinentalDataPortal granted Sites.FullControl.All

ContinentalDataPortal is a small internal data-browsing tool that needs Sites.Read.All at most. It was registered with Sites.FullControl.All (app-only) — which means it could create, delete, or modify any SharePoint site in the tenant. Almost certainly an accidental scope grant from the dev registering the app without admin pushback. Reduce to Sites.Read.All within 5 business days.

CIS Microsoft 365 2.7Over-permApp-only
Over-permissioned — ISV with no DLP

Slack has Files.Read.All without DLP integration

Slack Enterprise Grid holds Files.Read.All at the tenant level (app-only). The intended use is for the Slack-Outlook calendar integration only. Combined with the lack of a Microsoft Purview DLP policy covering Slack channels, this scope is broader than the business need. Either narrow to Files.Read.Selected + add DLP, or document the wider scope as accepted residual risk in the Decision Card.

Microsoft Purview DLPOver-permSlack
Unused — should revoke

Loom + Lucidchart unused for 90+ days

Loom (last used 134 days ago) and Lucidchart (110 days ago) retain delegated calendar/user scopes but are operationally dead. Both were pilots that never expanded. Auto-revoke per CIS Control 5.6 (dormant credential / authorization) — 90-day cap on unused OAuth tokens is the industry baseline.

CIS Control 5.6Dormant >90d2 apps
Scope creep — silent over-time growth

Microsoft Teams consented User.Read.All — only needs User.Read

Microsoft Teams client originally consented to User.Read only. During a Teams upgrade, a delegated User.Read.All scope was added (likely for the new "People" search panel). This expanded scope is now used by ALL Teams users — including those whose tenant doesn't require it. Pin the scope catalog to baseline + diff per quarterly review.

Scope creepMicrosoft 1PPin baseline
Secret expiring — rotation overdue

Datadog M365 audit-ingest client secret expires in 12 days

Datadog client secret used for the M365 audit-log ingest (AuditLog.Read.All app-only) is set to expire in 12 days. Datadog's connector falls back to silent ingestion failure when the secret expires — no alarm fires until audit log freshness lag exceeds 24h. Rotate immediately + update in Datadog connector config.

Secret rotation12-day windowSilent-failure risk
Conditional Access coverage gap

3 apps not covered by any CA policy

PagerDuty, ContractsAI-Pilot, and SalesIntelExtractor are NOT covered by any Conditional Access policy. That means: any user authenticated to the tenant can trigger these apps from any device, any location, without MFA. Apply the existing "Block legacy auth + require compliant device" policy to all 3 within the week.

Conditional Access gap3 appsMicrosoft 1P security baseline

Conditional Access coverage matrix

Conditional Access (CA) policies are the runtime enforcement layer over Entra app authorizations. Without a covering CA policy, an app can be used from any device, any location, by any user with a valid session — the consented scope is the ONLY guardrail. The App-coverage gap policy row highlights the 3 apps that need policy attachment within the week.

PolicyStateApps in scopeConditionsCoverage
Require MFA for all usersEnabledAll appsAll locationsAll apps · 30/30
Block legacy authenticationEnabledAll appsAll locationsAll apps · 30/30
Require compliant deviceEnabled (Intune)Office 365 + Microsoft Teams + SharePoint OnlineUntrusted networksSelective · 8 apps
Block guest access to high-riskEnabledExchange Online + SharePoint + Defender + ContinentalDataPortalGuest tenantsSelective · 4 apps
Require Entra Verified ID for executivesPilotAll appsVP+ executive groupPilot · 12 users
Block from non-allowed countriesEnabledAll appsUS + CA + EU + UK + JP onlyCountry-allowlist · 30/30
Sign-in risk policy (block high-risk)EnabledAll appsIdentity Protection signalAdaptive · 30/30
App-coverage gap policyRecommended-onlyPagerDuty + ContractsAI-Pilot + SalesIntelExtractorUntrusted networks3 apps NOT covered

Audit chain

Every consent grant, scope-creep detection, unused-revoke, secret-rotation event, CA-policy application, app-only anomaly, delegated-consent revocation, and high-risk-scope flag is emitted as a hash-chained event. Each event signs the prior event's hash, making the log tamper-evident.

Audit chain · ed25519-signed, hash-chained per CIS Control 8.5 audit-log integrity. Verify via mcp-kinetic-gain → audit_chain_verify tool.
2026-06-02T15:14:22Zscopes.entra.consent-grantedGreenhouse · Mail.Send + Calendars.ReadWrite (delegated)…c41a08
2026-06-02T15:08:31Zscopes.entra.scope-creep-detectedMicrosoft Teams · User.Read.All added since baseline…9b3742
2026-06-02T14:51:18Zscopes.entra.unused-revokedLoom · 134d unused → revoke recommendation queued…7e0d99
2026-06-02T14:38:55Zscopes.entra.secret-rotation-dueDatadog · client secret expires in 12 days…5a811c
2026-06-02T14:22:07Zscopes.entra.conditional-access-appliedPagerDuty · 'Block legacy auth + require compliant device' attached…3f6e2b
2026-06-02T13:59:44Zscopes.entra.app-only-anomalySlack · Files.Read.All used outside DLP-monitored window…1c8a55
2026-06-02T13:31:02Zscopes.entra.delegated-consent-revokedLucidchart · revoked (110d unused, manual purge)…b2447f
2026-06-02T13:08:19Zscopes.entra.high-risk-scope-flaggedContinentalDataPortal · Sites.FullControl.All flagged for review…8d05e1

Why this surface exists

Microsoft Graph permission scopes are the runtime trust boundary between every SaaS app and the M365 tenant. The runtime ops problem is not granting the scope at consent time — it's the silent drift after consent: unused-but-still-authorized apps, scope creep from in-place upgrades, client secrets expiring without alarm, Conditional Access policies that don't actually cover the apps that ship them. This surface makes that drift visible. The 6 anomaly patterns are the patterns that show up in every real B2B SaaS audit — over-permissioned in-house apps, unused dormants, scope creep, CA coverage gaps, secret-expiry silent-failures, and ISVs holding broader scopes than their use case.

Buyer: Microsoft 365 security teams · Entra admins · IAM teams running OAuth scope reviews · Compliance teams during SOX ITGC or CIS Microsoft 365 benchmark reviews · External auditors during evidence-collection windows.

Regulatory anchors: CIS Microsoft 365 Foundations Benchmark v3 · CIS Controls v8 5.6 + 6.7 + 8.5 · SOX ITGC · NIST 800-53 AC-2 + AC-6 + IA-5 · ISO 27001 A.9.2 + A.9.4 · Microsoft Zero Trust security baseline · Microsoft Purview DLP.

KG Suite tie-back: Every operator decision on this surface emits an audit-stream event (hash-chained, ed25519-signable). Vault-contract data classification follows the Decision Card v0.3 pattern (data_vault_targets + retention_envelope). Incident escalations match the AI Incident Card profile shape. Evidence bundles align with the AI Evidence Format spec.

Static-only doctrine: No backend. No login. No telemetry. All synthetic data is baked into this HTML page as JavaScript constants. Nothing leaves the tab. Frame as readiness / evidence / posture / controls / scaffolding — never "compliant" or "certified" without an externally-attested audit.