Product · OAuth governance
See every app that holds access to your tenant.
Applications consented into Entra keep the permissions they were given. AccessLens inventories them, scores each one on what it can reach and how it got there, and recommends what to do.
- AI Calendar HelperContacts.Read · 3 usershigh
- DocSync EnterpriseFiles.ReadWrite.All · Admin consenthigh
- MeetingNotes ProChat.Read.All · 1 usermedium
- Contoso Internal AnalyticsUser.Read.All · Admin consentmedium
- Microsoft TeamsUser.Read · Admin consentlow
- Office 365 SharePoint OnlineUser.Read · Admin consentlow
Why it scored critical
SmartMail Assistant
score 195 · 5 scopes
- Persistent refresh token (offline_access)
- Unverified publisher
- User-consented (bypasses admin review)
- Owned by an external tenant
- Consent granted within the last 7 days
8 apps hold consented access to this demo tenant. 1 is critical and 2 are high risk, and 3 were let in by users rather than an administrator.
Features
- The whole consent inventory
- Scopes weighted by risk
- Four risk tiers
- Automatic critical
- Recommendations
- Agent access (preview)
- full_access_as_userLegacyEWS full mailbox access; legacy, often abused100
- Mail.SendMailboxSend mail as user; enables outbound phishing95
- Mail.Send.SharedMailboxSend mail on behalf of shared mailboxes95
- IMAP.AccessAsUser.AllLegacyIMAP mailbox access95
- POP.AccessAsUser.AllLegacyPOP mailbox access95
- Mail.ReadWriteMailboxRead and write mailbox92
- SMTP.SendLegacySMTP send, outbound phishing vector92
- Sites.FullControl.AllFilesFull control of all SharePoint sites92
- Directory.ReadWrite.AllDirectoryRead and write directory data92
- Mail.ReadMailboxRead user mailbox90
- Mail.ReadWrite.SharedMailboxRead/write shared mailboxes90
- Files.ReadWrite.AllFilesRead and write all files88
Every scope weighed for what it can reach
33 sensitive scopes carry their own weight, from reading a mailbox to full access as the user. An app scores from its heaviest.
Every app, in its tier
The score is adjusted for an unverified publisher, user consent, an external owner or recent consent, and lands as critical, high, medium or low.
- Critical1SmartMail Assistant
- High2AI Calendar Helper, DocSync Enterprise
- Medium2MeetingNotes Pro, Contoso Internal Analytics
- Low3Microsoft Teams, Office 365 SharePoint Online, Office 365 Exchange Online
The rule no score can argue with
A sensitive scope from an unverified publisher, granted by user consent, is critical however the rest of it scores.
- A sensitive scopeMail.Send
- An unverified publishernot verified
- Granted by user consent2 users
All three together make an app critical, whatever else it scores.
What it answers
Three questions, settled.
- 01
Which apps can reach our data?
Every service principal with delegated or application permissions, the scopes it holds, whether an admin or individual users consented, and when.
- 02
Which of them should worry me?
Each app is scored from the risk of its scopes, then adjusted for an unverified publisher, user consent, an external owner or recent consent. It lands as critical, high, medium or low.
- 03
What should I do about them?
Recommendations such as revoking high-risk apps with no recent activity or restricting an app to admin consent. You act on them in Entra; AccessLens changes nothing.
Plans
Free, on every plan.
Read from the same configuration the product uses to gate features.
- OAuth App AuditEvery plan
Free
For admins who want a clear first view of their Conditional Access posture.
| Limit | Free | Starter | Professional | Enterprise |
|---|---|---|---|---|
| OAuth App Audit | View only |
Reading app permissions needs Application.Read.All and DelegatedPermissionGrant.Read.All consent. Consent events and activity also need AuditLog.Read.All.
The rest of the product
More views of the same tenant.
Find the app nobody remembers approving.
Read-only · no credit card · start with ten policies