How to report permissions for all your Entra ID (Azure Active Directory) app registrations

You can look up all your app registrations in the Microsoft Entra admin center under App registrations, where you’ll see a paginated view of key application attributes such as the app name, app ID, creation date, and whether certificates or secrets have expired or are close to expiring. Because the list is paginated, you have to keep loading more to see everything, which makes it hard to get a full overview when you’re cleaning up a large number of app registrations that have accumulated over the years.

For a complete report, Microsoft Graph PowerShell can do the job, and you can build a custom script around the ‘Get-MgApplication -All’ cmdlet to list all app registrations.

If you want the same tenant-wide visibility without building and maintaining a script, sapio365 is the easiest route.

sapio365 is a third-party tool that connects to Microsoft 365 and retrieves directory data in a fast, Excel-style interface, while handling the Graph calls and data relationships behind the scenes. The goal of sapio365 is to give admins a single-pane, grid-based view of Entra data, including app registrations and their permissions, with instant filtering, analytics, and no scripting.

Here’s how easy it is to create a permissions report for all Entra app registrations.

With one click in sapio365, you get a full list of app registrations and key properties such as:

• Creation and modification dates.
• App owners.
• App descriptions.
• App ID.
• Expiration dates for secrets and certificates.
• Delegated and application permissions, including scope and role names.
• Much more.

You can also customize the view by showing or hiding any of these columns.

Because sapio365 is designed for custom reporting, you can filter the grid or group apps by permission to quickly isolate risky entries such as Directory.ReadWrite.All and User.ReadWrite.All, as well as permissions that Microsoft has deprecated or plans to retire. All of this happens interactively, so you can sort, group, and filter with clicks instead of re-running scripts.

Once you’ve narrowed down what you want to present to your security or governance team, you can:

1. Keep only the relevant columns, such as permission names and permission type, and save that view for later.
2. Export the full grid or just the filtered rows to CSV or Excel.
3. Schedule the customized report to run weekly and send the exported file to yourself or others automatically.
4. Use scheduled reports as exception alerts so you’re notified when app registrations have permissions outside your defined scope.

That turns your report of permissions for all Entra registered apps into a reusable audit instead of a one-off PowerShell project. You can create as many custom reports and exception-based alerts as you need.

Because sapio365 also exposes other Microsoft 365 directory objects, you can use it for broader security checks too. For example, you can cross-check app owners and their admin roles, review last sign-in dates for service principals to find unused apps, and audit other Entra and Microsoft 365 data without switching between PowerShell scripts or modules.

If you’re ready to act on certain apps, you can do it directly from sapio365. You can disable or delete apps by selecting them and applying the action in a few clicks, and sapio365 gives you a preview of the changes before you commit them.

Here’s a quick side-by-side view of the three approaches.