Feature Request: Search App Registrations / Enterprise Apps by API Permission

[dbgalz11]

Hi team,

First of all, thanks for building EntraFalcon — it's a really useful tool for reviewing Entra ID security posture.

One feature that would be very helpful during audits is the ability to search for App Registrations or Enterprise Applications that have a specific API permission.

In larger tenants, there can be a lot of applications, and when reviewing the report it can take some time to manually find which apps have sensitive permissions such as:

Directory.ReadWrite.All
Application.ReadWrite.All
RoleManagement.ReadWrite.Directory

It would be great if EntraFalcon could allow something like filtering or searching for apps that contain a specific permission.

This would make it much easier during security reviews to quickly identify apps with high-privilege permissions.
Thanks for considering this!

[zh54321]

Hi @dbgalz11

Thank you for the feedback and suggestion.

At the moment, the main option is to use the built-in filters for applications with extensive API permissions based on our rating categories, such as Dangerous or High. As a workaround, it is also possible to expand all application detail sections using the Expand All button and then use the browser search to look for a specific permission. However, I agree that this is cumbersome in large tenants.

We are planning to release an update next week that will provide a better overview of applications with extensive permissions. It will also support searching for specific permissions that are currently classified as Dangerous, High or Medium.

I will update this issue again as soon as the release is available. You can then let me know whether the new feature meets your needs.

[zh54321]

Hi @dbgalz11

I have just released the version containing the new Security Findings Report. For example the finding ENT-004 displays all foreign enterprise applications together with the permissions that we categorize as Dangerous, High, or Medium:

This should make it much easier to identify privileged applications quickly.

At the moment, we categorize 58 application permissions and 79 delegated permissions. The full list is available in the README file.

In addition, the results can be further filtered and searched. The list of affected applications and permissions can also be exported in different formats.

Let me know whether the new Security Findings Report meets your needs for reviewing API permissions in large tenants.

There are also additional findings related to applications and API permissions:
ENT-005: Foreign Enterprise Applications with Extensive API Privileges (Delegated)
ENT-009: Internal Enterprise Applications with Extensive API Privileges (as Application)
ENT-010: Internal Enterprise Applications with Extensive API Privileges (Delegated)