--- title: How to review Microsoft 365 app permissions | Vahti description: What can applications do in Microsoft 365? Check their permissions, purpose and who is responsible before changing access. image: https://vahti.ai/hubfs/blog/m365-artikkelit-2026/applications/en/vahti-applications-hero-en-v1.png --- [Skip to content](https://vahti.ai/en/blog/review-microsoft-365-application-permissions#main-content) [![Vahti](https://vahti.ai/hubfs/vahti-logo-vaaka-sininen.svg)Homepage](https://vahti.ai?hsLang=en) - [Home](https://vahti.ai?hsLang=en) - [Product](https://vahti.ai/tuote?hsLang=en) - [Pricing](https://vahti.ai/hinnoittelu?hsLang=en) - [Trust](https://vahti.ai/luottamus?hsLang=en) - [Login](https://app.vahti.ai/en/login) - [Try Vahti](https://app.vahti.ai/en/login?view=register_intro) English Select a language ✕ - [Suomi](https://vahti.ai/blog/microsoft-365-sovellusoikeuksien-tarkistus) - [English](https://vahti.ai/en/blog/review-microsoft-365-application-permissions) - [Home](https://vahti.ai?hsLang=en) - [Product](https://vahti.ai/tuote?hsLang=en) - [Pricing](https://vahti.ai/hinnoittelu?hsLang=en) - [Trust](https://vahti.ai/luottamus?hsLang=en) - [Login](https://app.vahti.ai/en/login) - [Try Vahti](https://app.vahti.ai/en/login?view=register_intro) English Select a language - [Suomi](https://vahti.ai/blog/microsoft-365-sovellusoikeuksien-tarkistus) - [English](https://vahti.ai/en/blog/review-microsoft-365-application-permissions) ![What can your apps access? The Vahti character holds a card with an application icon.](https://vahti.ai/hs-fs/hubfs/blog/m365-artikkelit-2026/applications/en/vahti-applications-hero-en-v1.png?width=1899&height=828&name=vahti-applications-hero-en-v1.png) Microsoft 365 Security Blog # What can applications do in your company’s Microsoft 365 environment? ![Teemu Tapper](https://vahti.ai/hs-fs/hubfs/1.png?width=48&height=48&name=1.png) Teemu Tapper September 17, 2026 Applications may also have access to your company’s Microsoft 365 data. Here is how to find out what an application is allowed to do, why it is needed and whether its permissions are still justified. A sales tool, booking service or backup service may need access to company emails, calendars or files. That access may be necessary for the service to work. But recognising an application’s name does not tell you what data it is allowed to handle. Your IT team may not be familiar with every tool used across the company. IT can check the permissions, while the team using the application knows why it is needed. That makes the review a shared task. ## Example: the trial ended, but the application’s permissions remained Imagine a company whose sales team has tried a tool to help manage email. At the start of the trial, the application was granted permission to read a user’s emails. The team later chose another service, but nobody reviewed the old tool’s permissions. Finding the application in the company’s environment does not, on its own, mean that it has been misused. What matters is finding out who introduced it, what permissions it was granted and whether anyone still uses it. The tool may serve another purpose that IT is not aware of. The person responsible in sales confirms that the old service is no longer needed. IT checks the associated connections and agrees on removing the permissions. The team also makes sure the data it needs is available and its workflows function in the new service. **The aim of the review is to establish whether the application’s permissions match what it currently needs to do.** ## Does the application act on behalf of a user or independently? There are two main ways an application can access Microsoft 365 data: - **An application acting on behalf of a user** uses delegated permissions. Its access is limited by both the permissions granted to the application and the user’s own permissions. With delegated permissions, the application cannot access data that the user cannot access. - **An application acting independently** uses application permissions. It can operate without a signed-in user, for example to run backups in the background. The extent of its access depends on the permissions granted to it and any restrictions applied by the relevant service. The same permission name can mean different levels of access in these two scenarios. In Microsoft’s example, the delegated **Files.Read.All** permission allows an application to read files that the user can access. As an application permission, it allows the application to read all files in the organisation through Microsoft Graph. Always check the permission type as well as its name. Read more in [Microsoft’s guide to permissions and consent](https://learn.microsoft.com/en-us/entra/identity-platform/permissions-consent-overview). **Administrator approval alone does not tell you the permission type.** An administrator can also approve delegated permissions for an application that acts on a user’s behalf. The permissions an application has and the person who approved them are separate matters. Microsoft explains the distinction in its [guide to user and admin consent](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/user-admin-consent-overview). ## How to review one application ### 1. Identify its purpose and the person responsible for it Start with an application whose trial has ended or whose purpose is unclear. Find out who provides the service, who uses it and who is responsible for its use in your company. Ask what the application does and what would be affected if people stopped using it. Keep a brief record of the answers. Even one sentence helps: “The sales team uses the service to book meetings, and the sales manager is responsible for its use.” ### 2. Check the permissions granted in Microsoft Entra In the Microsoft Entra admin centre, go to **Entra ID → Enterprise apps → All applications**. Select the application and open **Permissions**. Review both tabs: **Admin consent** and **User consent**. Menu names may vary with the language of the interface. Check each permission’s description and type: can the application read, change or send data, and which service’s data does the permission cover? The person carrying out the review needs an appropriate administrative role. Microsoft’s [guide to reviewing application permissions](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/manage-application-permissions) describes the required roles and views. ### 3. Compare the permissions with how the application is used Discuss three questions with the person responsible for the application: - Is the application still needed? - What company data does it need to handle? - Does it need all its current permissions to do that job? If a permission seems broader than the application’s purpose requires, ask the service provider to explain why it is needed and find out whether access can be restricted. Microsoft recommends assessing both the publisher’s trustworthiness and the need for the requested permissions before approving them. See [Microsoft’s guidance on evaluating application consent requests](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/manage-consent-requests). ### 4. Distinguish granted permissions from actual use **Permission to read emails is not proof that the application has read them.** The permissions list shows what access is allowed. Investigate what the application has actually done separately, using the usage data and logs available to you. Microsoft distinguishes between granted permissions, permission usage and the amount of data handled in the [Defender for Cloud Apps application inventory](https://learn.microsoft.com/en-us/defender-cloud-apps/applications-inventory). Do not treat missing usage data as proof that an application is not being used. ### 5. Make the agreed change and check that everything still works If a permission is unnecessary, agree on its removal with the person responsible for the application. If the application is still in use, establish the impact of restricting its permissions before making the change. Do not remove an unfamiliar application based on its name alone. IT makes the change to the correct application and checks with its users that the functions they need still work. Permissions granted through consent are not the only way an application can gain access to data. Access can also come from authorisations within individual services. Microsoft explains these considerations in its [guide to reviewing and revoking permissions](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/manage-application-permissions). ## How does Vahti help with application reviews? Vahti’s interactive demo lets you explore findings related to applications. IT and the person responsible for using the application can assess a finding together: what does it mean, and what should they investigate next? [![Vahti’s Applications and services view shows an example application’s broad permissions and findings that need review.](https://vahti.ai/hs-fs/hubfs/blog/m365-artikkelit-2026/applications/en/vahti-applications-demo-en.webp?width=1536&height=1024&name=vahti-applications-demo-en.webp)](https://app.vahti.ai/en/demo) An example from Vahti’s public demo. The applications and findings shown are illustrative. A finding can be the starting point for a review. Deciding whether an application is needed still requires an understanding of how the company uses it. An application finding in Vahti is not, on its own, proof of data misuse. It does not replace a separate assessment of the permissions granted and how they have actually been used. ## Review permissions when a trial ends, too Management should make sure each company tool has a named person responsible for it. IT checks permissions and makes changes. The team using the tool explains what it needs from the application. It is also worth reviewing permissions when switching services or when the person responsible for an application leaves the company. **Start with one application.** Record its purpose, the person responsible for it, its key permissions and the agreed next step. Use the same checklist when introducing the next tool. [**Explore Vahti’s interactive demo**](https://app.vahti.ai/en/demo) to see application findings alongside user risks, file sharing and email rules. Find out more on the [Vahti product page](https://vahti.ai/en/product?hsLang=en). ## Share this post [mailto:https%3A%2F%2Fvahti.ai%2Fen%2Fblog%2Freview-microsoft-365-application-permissions](mailto:https%3A%2F%2Fvahti.ai%2Fen%2Fblog%2Freview-microsoft-365-application-permissions) ## Keep reading ### [![The Vahti guardian holds a card showing a key and connected applications. Text: Monitor application access too.](https://vahti.ai/hs-fs/hubfs/blog/monitor-microsoft-365-application-access/cover-vahti-en-v1.webp?width=1672&height=941&name=cover-vahti-en-v1.webp) Microsoft 365 Security Blog Monitoring Microsoft 365 application access | Vahti](https://vahti.ai/en/blog/monitor-microsoft-365-application-access?hsLang=en) ### [![Suspect an account takeover? Find out what happened. The Vahti character examines a user card and checklist with a magnifying glass.](https://vahti.ai/hs-fs/hubfs/blog/microsoft-365-account-takeover-investigation/cover-en.webp?width=1672&height=941&name=cover-en.webp) Microsoft 365 Security Blog Suspect a Microsoft 365 account takeover? Here's how to investigate](https://vahti.ai/en/blog/microsoft-365-account-takeover-investigation?hsLang=en) --- ![vahti-logo-vaaka-sininen](https://vahti.ai/hubfs/vahti-logo-vaaka-sininen.svg "vahti-logo-vaaka-sininen") Security monitoring for Microsoft 365 #### Product - [Features](https://vahti.ai/tuote?hsLang=en) - [GDPR File Review](https://vahti.ai/en/gdpr-file-review?hsLang=en) - [Pricing](https://vahti.ai/hinnoittelu?hsLang=en) - [Trust](https://vahti.ai/luottamus?hsLang=en) - [See how to get started](https://vahti.ai/aloita-kaytto?hsLang=en) - [FAQ](https://vahti.ai/faq?hsLang=en) #### Company - [About us](https://vahti.ai/meista?hsLang=en) - [Blog](https://vahti.ai/blog?hsLang=en) - [Contact](https://vahti.ai/ota-yhteytta?hsLang=en) #### Legal - [Terms of Service](https://vahti.ai/kayttoehdot?hsLang=en) - [Privacy Policy](https://vahti.ai/tietosuojaseloste?hsLang=en) - [Data Processing Agreement (DPA)](https://vahti.ai/tietojenkasittelysopimus-dpa?hsLang=en) - [Subprocessors](https://vahti.ai/alikasittelijalista?hsLang=en) - [Cookie Policy](https://vahti.ai/evastekaytanto?hsLang=en) --- © 2026 Vahti Service Oy. All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Teemu Tapper", "url" : "https://vahti.ai/en/blog/author/teemu-tapper" }, "dateModified" : "2026-10-19T14:01:09.017Z", "datePublished" : "2026-09-17T07:47:23.000Z", "headline" : "How to review Microsoft 365 app permissions | Vahti", "image" : [ "https://vahti.ai/hubfs/blog/m365-artikkelit-2026/applications/en/vahti-applications-hero-en-v1.png" ], "mainEntityOfPage" : { "@id" : "https://vahti.ai/en/blog/review-microsoft-365-application-permissions", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://vahti.ai/hubfs/vahti-logo-vaaka-sininen.svg" }, "name" : "Vahti Service Oy" } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://vahti.ai/#organization", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "FI", "addressLocality" : "Jyväskylä", "postalCode" : "40100", "streetAddress" : "Kauppakatu 39" }, "email" : "contact@vahti.ai", "legalName" : "Vahti Service Oy", "logo" : "https://vahti.ai/hubfs/vahti-logo-1.png", "name" : "Vahti", "sameAs" : [ "https://www.linkedin.com/company/vahti" ], "taxID" : "3598836-2", "url" : "https://vahti.ai", "vatID" : "FI35988362" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://vahti.ai/#website", "@type" : "WebSite", "name" : "Vahti", "publisher" : { "@id" : "https://vahti.ai/#organization" }, "url" : "https://vahti.ai" } ```