Solution GetDirectoryRegApplication

Directory Applications report

Solution Code: GetDirectoryRegApplication

Description

This report lists the App Registrations in your Entra ID tenant, including their sign-in configuration, credentials, owners and the permissions they request. A NeedsReview column flags common hygiene/security concerns.

Column Title	Description
Id	Application object ID
DisplayName	Name of the app registration
ClientId	Application (client) ID
PublisherDomain	Publisher domain
ApplicationAudience	Single tenant / Multitenant / Personal, etc.
CreatedDate	When the app registration was created
Notes	Free-text notes on the app object
VerifiedPublisher	No, or Yes - <publisher>
HasWildcardRedirectUri	Whether any redirect URI contains a wildcard
RedirectUris	All web / SPA / public-client redirect URIs
LogoutUrl	Configured front-channel logout URL
ImplicitFlowEnabled	Whether ID-token implicit issuance is enabled
AccessTokenFlowEnabled	Whether access-token implicit issuance is enabled
AllowPublicClient	Whether the app is treated as a public client
SecretCount / SecretsValid / SecretExpired / SecretExpiringIn30Days	Client-secret credential counts
CertCount / CertsValid / CertExpired / CertExpiringIn30Days	Certificate credential counts
OwnersCount / Owners	Number and list of owners (None when empty)
DelegatedPermissions	Requested delegated scopes with consent status [Admin/User/Not Consented]
ApplicationPermissions	Requested app roles with consent status [Consented/Not Consented]
HasExcessiveAccess	Application permission contains a high-impact keyword (write/edit/manage/fullcontrol)
PotentialExcessiveAccess	Delegated permission contains a high-impact keyword
NeedsReview	Summary of flagged concerns (see below)
Remarks	Remarks/errors captured while building the row

NeedsReview combines any of: expired secret, expired certificate, wildcard redirect URI, implicit flow enabled, access-token flow enabled, excessive permissions, potential excessive access, no owners.

Requirements

API	Delegated	Application
Microsoft Graph	Application.Read.All Directory.Read.All	Application.Read.All
RBAC	Global Reader*	NA

Global Reader, Application Administrator or Cloud Application Administrator.

Parameters

This Solution has no parameters.

How this Solution works

1. Retrieves all app registrations in the tenant, plus a lookup of service principals by app ID.
2. For each registration, retrieves its owners and resolves each requested permission (delegated scope / app role) to a readable value, marking whether it has been consented.
3. Computes the NeedsReview flags and records one row per app registration.

Notes

See Understanding Entra ID App Types for the difference between delegated and application permissions.