Solution GetDirectoryAppAudit

Directory Application Audit

Solution Code: GetDirectoryAppAudit

Description

A combined security audit that correlates each Enterprise Application (service principal) with its App Registration, surfacing credentials, owners, sign-on configuration, granted permissions and (optionally) recent sign-in activity. The NeedsReview column aggregates all detected concerns into a single actionable field.

Column Title	Description
Id / DisplayName / AppId	Service principal identity
ServicePrincipalType	Application, ManagedIdentity, Legacy, etc.
AppOwnerOrganizationId / AppOwnerOrganization	Owning tenant, classified Internal / Microsoft / Third Party
PublisherName / PublisherDomain	Verified publisher and domain
ApplicationAudience	Single tenant / Multitenant / Personal, etc.
CreatedDateTime	When the service principal was created
EnterpriseAppNotes / RegisteredAppNotes	Notes stored on the SP and on the app registration
ServPrincipalOwnersCount / ServPrincipalOwners	Enterprise-app owners
AppRegOwnersCount / AppRegOwners	App-registration owners
SamlSso / ExposesApi	Sign-on configuration flags
ReplyUrls / HasWildcardReplyUrl	Reply URLs and wildcard flag
ImplicitFlowEnabled / AccessTokenFlowEnabled / AllowPublicClient	Risky auth-flow flags
SpSecretStatus / SpCertStatus / SpSecretCertDetails	Service-principal credential status/details
AppRegSecretStatus / AppRegCertStatus / AppRegSecretCertDetails	App-registration credential status/details
HasSignInLast30Days / HasDelegatedSignInLast30Days / HasApplicationSignInLast30Days	Recent sign-in activity (only when the option is enabled)
AssignmentRequired	Whether user assignment is required
GrantedDelegatedPermissions / GrantedApplicationPermissions	Consented permissions
HasExcessiveApplicationPermissions / PotentialExcessiveDelegatedPermissions	High-impact-keyword flags
HasUnconsentedApplicationPermissions	App declares roles that are not granted
HasOrphanedApplicationPermissions	App has grants not declared in the registration
NeedsReview	Aggregated list of all detected concerns
Remarks	Remarks/errors captured while building the row

Requirements

API	Delegated	Application
Microsoft Graph	Application.Read.All Directory.Read.All AuditLog.Read.All*	Application.Read.All AuditLog.Read.All*
RBAC	Global Reader**	NA

AuditLog.Read.All is only needed when Include sign-in activity is enabled, and that data requires a Microsoft Entra ID P1/P2 tenant. *Global Reader, Application Administrator or Cloud Application Administrator.

Parameters

Parameter	Type	Definition
Include third-party apps	Optional	Include apps owned by other tenants (default off).
Include Microsoft apps	Optional	Include Microsoft-owned first-party apps (default off).
Include SP owners (internal apps)	Optional	Fetch enterprise-app owners for internal apps (default on).
Include SP owners (Microsoft apps)	Optional	Fetch owners for Microsoft-owned apps (default off).
Include SP owners (third-party apps)	Optional	Fetch owners for third-party apps (default off).
Include sign-in activity	Optional	Fetch last-30-day sign-in activity (requires AuditLog.Read.All + Entra ID P1/P2; default off).

By default (all "include" options off except internal-app owners) the report covers only internally owned applications.

How this Solution works

1. Retrieves all app registrations and all service principals, then indexes them so each service principal can be matched to its registration.
2. Optionally retrieves tenant-wide service-principal sign-in activity.
3. For each service principal (filtered by the include options), it:
   • Enriches the row with data from the matching app registration.
   • Fetches owners (per the include options), delegated grants and application role assignments concurrently, resolving resources/roles to readable names.
   • Compares declared vs. granted application permissions to detect unconsented and orphaned permissions.
   • Computes the aggregated NeedsReview flags.
4. Records one row per service principal.

Notes

This audit is the most comprehensive of the three directory reports; use GetDirectoryServicePrincipal or GetDirectoryRegApplication for a lighter, single-object view. Credential status is summarised as None / Valid / Expired, with counts in the *Details columns.