Defender-OAuthAppInfo

ActionTypeTitleSampleRule
anyOAuth application informationYN

any: OAuth application information

#
Table
OAuthAppInfo

Example Event #

{
  "AddedOnTime": "2026-06-30T14:42:59Z",
  "AppName": "dw-activity-gen",
  "AppOrigin": "Internal",
  "AppOwnerTenantId": "00000000-0000-0000-0000-000000000001",
  "AppStatus": "Enabled",
  "AssignedRoles": [
    {
      "RoleId": "17315797-102d-40b4-93e0-432062caca18",
      "RoleName": "Compliance Administrator",
      "RoleType": "Built-In",
      "PrivilegeLevel": "High",
      "RoleProvider": "Entra"
    },
    {
      "RoleId": "29232cdf-9323-42fd-ade2-1d097af3e4de",
      "RoleName": "Exchange Administrator",
      "RoleType": "Built-In",
      "PrivilegeLevel": "High",
      "RoleProvider": "Entra"
    }
  ],
  "AssignedRoles@odata.type": "#Collection(String)",
  "IsAdminConsented": 1,
  "IsAdminConsented@odata.type": "#SByte",
  "LastUsedTime": "2026-07-30T00:40:38.405Z",
  "OAuthAppId": "22222222-2222-2222-2222-222222222222",
  "Permissions": [
    {
      "PermissionType": "Delegated",
      "PermissionValue": "AuditLogsQuery.Read.All",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "PrivilegeLevel": "NA"
    },
    {
      "PermissionType": "Delegated",
      "PermissionValue": "ChannelMember.ReadWrite.All",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "InUse": "false",
      "PrivilegeLevel": "Medium"
    },
    {
      "PermissionType": "Delegated",
      "PermissionValue": "Channel.Delete.All",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "InUse": "false",
      "PrivilegeLevel": "Medium"
    },
    {
      "PermissionType": "Delegated",
      "PermissionValue": "Files.ReadWrite",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "InUse": "true",
      "PrivilegeLevel": "High"
    },
    {
      "PermissionType": "Delegated",
      "PermissionValue": "TeamSettings.ReadWrite.All",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "InUse": "false",
      "PrivilegeLevel": "Low"
    },
    {
      "PermissionType": "Delegated",
      "PermissionValue": "SubjectRightsRequest.Read.All",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "PrivilegeLevel": "NA"
    },
    {
      "PermissionType": "Application",
      "PermissionValue": "AccessReview.ReadWrite.All",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "InUse": "Not supported",
      "PrivilegeLevel": "High"
    },
    {
      "PermissionType": "Application",
      "PermissionValue": "EntitlementManagement.ReadWrite.All",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "InUse": "Not supported",
      "PrivilegeLevel": "High"
    },
    {
      "PermissionType": "Application",
      "PermissionValue": "RecordsManagement.ReadWrite.All",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "PrivilegeLevel": "NA"
    },
    {
      "PermissionType": "Delegated",
      "PermissionValue": "Sites.ReadWrite.All",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "InUse": "true",
      "PrivilegeLevel": "High"
    },
    {
      "PermissionType": "Delegated",
      "PermissionValue": "TeamMember.ReadWrite.All",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "InUse": "false",
      "PrivilegeLevel": "Medium"
    },
    {
      "PermissionType": "Application",
      "PermissionValue": "RoleEligibilitySchedule.ReadWrite.Directory",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "PrivilegeLevel": "NA"
    },
    {
      "PermissionType": "Delegated",
      "PermissionValue": "eDiscovery.ReadWrite.All",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "PrivilegeLevel": "NA"
    },
    {
      "PermissionType": "Delegated",
      "PermissionValue": "Contacts.ReadWrite",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "InUse": "false",
      "PrivilegeLevel": "Medium"
    },
    {
      "PermissionType": "Delegated",
      "PermissionValue": "Tasks.ReadWrite",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "InUse": "Not supported",
      "PrivilegeLevel": "NA"
    },
    {
      "PermissionType": "Delegated",
      "PermissionValue": "User.Read",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "InUse": "Not supported",
      "PrivilegeLevel": "Low"
    },
    {
      "PermissionType": "Delegated",
      "PermissionValue": "ChannelMessage.Send",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "InUse": "false",
      "PrivilegeLevel": "Low"
    },
    {
      "PermissionType": "Application",
      "PermissionValue": "eDiscovery.ReadWrite.All",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "PrivilegeLevel": "NA"
    },
    {
      "PermissionType": "Delegated",
      "PermissionValue": "Team.Create",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "InUse": "false",
      "PrivilegeLevel": "High"
    },
    {
      "PermissionType": "Delegated",
      "PermissionValue": "Group.ReadWrite.All",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "InUse": "Not supported",
      "PrivilegeLevel": "High"
    },
    {
      "PermissionType": "Application",
      "PermissionValue": "RoleAssignmentSchedule.ReadWrite.Directory",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "PrivilegeLevel": "NA"
    },
    {
      "PermissionType": "Delegated",
      "PermissionValue": "Channel.Create",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "InUse": "false",
      "PrivilegeLevel": "Low"
    },
    {
      "PermissionType": "Application",
      "PermissionValue": "RoleManagement.ReadWrite.Directory",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "InUse": "Not supported",
      "PrivilegeLevel": "High"
    },
    {
      "PermissionType": "Delegated",
      "PermissionValue": "MailboxSettings.ReadWrite",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "InUse": "true",
      "PrivilegeLevel": "High"
    },
    {
      "PermissionType": "Delegated",
      "PermissionValue": "Calendars.ReadWrite",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "InUse": "false",
      "PrivilegeLevel": "Medium"
    },
    {
      "PermissionType": "Delegated",
      "PermissionValue": "RecordsManagement.ReadWrite.All",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "PrivilegeLevel": "NA"
    },
    {
      "PermissionType": "Delegated",
      "PermissionValue": "Mail.Send",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "InUse": "false",
      "PrivilegeLevel": "High"
    },
    {
      "PermissionType": "Delegated",
      "PermissionValue": "Mail.ReadWrite",
      "TargetAppDisplayName": "Microsoft Graph",
      "TargetAppId": "00000003-0000-0000-c000-000000000000",
      "InUse": "false",
      "PrivilegeLevel": "High"
    },
    {
      "PermissionType": "Delegated",
      "PermissionValue": "Exchange.AdminAPI.Manage",
      "TargetAppDisplayName": "Office 365 Exchange Online",
      "TargetAppId": "00000002-0000-0ff1-ce00-000000000000",
      "PrivilegeLevel": "NA"
    },
    {
      "PermissionType": "Application",
      "PermissionValue": "Exchange.ManageAsApp",
      "TargetAppDisplayName": "Office 365 Exchange Online",
      "TargetAppId": "00000002-0000-0ff1-ce00-000000000000",
      "PrivilegeLevel": "High"
    },
    {
      "PermissionType": "Delegated",
      "PermissionValue": "Exchange.Manage",
      "TargetAppDisplayName": "Office 365 Exchange Online",
      "TargetAppId": "00000002-0000-0ff1-ce00-000000000000",
      "PrivilegeLevel": "High"
    },
    {
      "PermissionType": "Delegated",
      "PermissionValue": "Exchange.ManageV2",
      "TargetAppDisplayName": "Office 365 Exchange Online",
      "TargetAppId": "00000002-0000-0ff1-ce00-000000000000",
      "PrivilegeLevel": "NA"
    }
  ],
  "Permissions@odata.type": "#Collection(String)",
  "PrivilegeLevel": "High",
  "ReportId": "9c2f6eae-1e83-402f-adc2-bc32be165ced",
  "RiskScore": 62,
  "ServicePrincipalId": "af2cee02-3ad4-4486-85a2-e8eafc78cd6e",
  "Timestamp": "2026-08-01T07:06:20.895Z",
  "VerifiedPublisher": {
    "@odata.type": "#microsoft.graph.security.dynamicColumnValue"
  }
}

References #