Microsoft Defender for Cloud Apps
Cloud and workloadsApp Governance Visibility Insights View Apps
In brief
The documentation now describes risk scores, last-used dates, and a Used by AI Agents (Preview) field. Salesforce inventory is also documented as including Connected Apps and External Client Apps.
What Defender admins need to know
Admins can use these details to assess OAuth app risk, permissions, usage, and AI-agent access. No administrator action is specified.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
For a summary of apps in your tenant, in Microsoft 365, go to Cloud app > App governance and select any of the apps tabs.
By default, the app governance page sorts the grid alphabetically, by AppDisplay name. To sort the list by another attribute, select the column name. You can also select Search to search for an app by name.
On the Microsoft 365 tab, the apps in your tenant are listed with the following details:
| Column name | Description |
|---|---|
| The display name of the app as registered on Microsoft Entra ID | |
| Shows whether the app is enabled or disabled, and if disabled by whom | |
| Risk score | Shows the identity risk score (1-100). Higher values indicate greater risk. |
| Graph API access | Shows whether the app has at least one Graph API permission |
| Permission type | Shows the app's permission type: - Delegated: Delegated API permissions only, no roles. - Application: Application API permissions only, no roles. - Microsoft Entra roles: Microsoft Entra roles only, no API permissions. - Mixed: A combination of any two or more of the above. - None: No API permissions or Entra roles assigned. |
| Shows whether the app originated within the tenant or was registered in an external tenant | |
| Consent type | Shows whether the app consent is given at the user or the admin level, and the number of users whose data is accessible to the app |
| Publisher | Publisher of the app and their verification status |
| Last used | Shows the last time when the app signed in. Tracking of this data goes back to June, 2022. |
| Used by AI Agents (Preview) | Shows the AI agents that use this identity to authenticate and access Microsoft 365 resources. If the value is N/A, agent details are unavailable, but the identity might still be used by AI agents. |
| Last modified | Date and time when registration information was last updated on Microsoft Entra ID |
| Added on | Shows the date and time when the app was registered to Microsoft Entra ID and assigned a service principal |
| Permission usage | Shows whether the app has any unused Graph API permissions in the last 90 days |
| App ID | The app ID |
| Sensitivity label accessed | Sensitivity labels on content accessed by the app |
| Service accessed | Microsoft 365 services accessed by the app |
| Community use | Shows how popular the app is |
| Consent grants | Shows all app consent grants in the last 30 days |
| App activities | Shows all app activities in the last 30 days |
The Risk score tab shows a 1-100 risk score for the app, where higher values mean greater risk. The risk score helps you quickly prioritize which apps need attention first. The Risk score tab also shows the risk summary, including the factors behind the app's risk score.
Note
The Risk score tab is available only for OAuth apps registered in Microsoft Entra ID.
Review app connections on the Graph tab
Manage Google Workspace and Salesforce OAuth apps
If you enableEnable the Google Workspace or Salesforce connector, you can useconnector to view connected app permissions on the App governance page to view information about app permissions in apps connected to Google Workspacepage. For Salesforce, the inventory includes both Connected Apps and Salesforce.External Client Apps (ECAs). You can view the permissions granted to each app and revoke or block apps as needed.
On the App governance page, select the Google apps or Salesforce apps tabs to view your apps. For example:
| New policy from search | Select to create a new OAuth app policy based on the current query results, For more information, see Create app policies in app governance. | | Export | Select to export the currently listed apps to a CSV file. |
View Google WorkforceWorkspace and Salesforce OAuth app details
The Google and Salesforce pages provide the following information about each OAuth app that users grant permissions to:
| Name | The app's name. Select to show or hide more details about the app. |
| Authorized by | The number of users who authorized this app to access their app's account, and granted the app permissions. Select to view more information, including a list of user emails and whether an admin previously consented to the app. On the Users who added... pane, select Export to export the listed users to a CSV file. |
| Permission level | High, Medium, or Low. The level indicates how much access this app has to the app's data. For example, Low might indicate that the app only accesses user profile and name. Select the level to view more information, including permissions granted to the app, community use, or related activity in the Governance log. |
| Last authorizedused | The most recent date on which a user granted permissions to this app. This information is available for Salesforce only.app was used by anyone in your organization. |
| Risk score | The app's risk score from 1 through 100. Higher values indicate greater risk. |
| Actions | Select an option to mark an app as approved or banned. |
Select Show details at the top right to view more information about all of the apps displayed, including:
| Column name | Description |
|---|---|
| Permissions | A list of all permissions currently granted to the app. |
| Community use | |
| App ID | The app's ID |
| App activities | A link to the app's activity log, which you can use to understand the app's recent usage. |
| \ No newline at end of file | |
| Last used | The most recent date on which this app was used by anyone in your organization. |
| \ No newline at end of file |
@@ -6,15 +6,15 @@ feedback_system: Standard feedback_product_url: https://docs.microsoft.com/cloud-app-security/support-and-ts uhfHeaderId: MSDocsHeader-MicrosoftDefender breadcrumb_path: /defender-cloud-apps/breadcrumb/toc.json-author: AbbyMSFT+author: anandd512 manager: bagol-ms.author: abbyweisberg+ms.author: andeshpande ms.collection: M365-security-compliance ms.service: defender-for-cloud-apps ms.suite: ems-ms.date: 2026-07-03T00:00:00.0000000Z+ms.date: 2026-09-28T00:00:00.0000000Z ms.topic: how-to-description: Learn how to view app details with app governance in Microsoft Defender XDR with Microsoft Defender for Cloud Apps.+description: Learn how to view OAuth app risk, permissions, usage, and connected AI agents with app governance in Microsoft Defender. ms.reviewer: anandd512 ms.custom: sfi-image-nochange, msecd-doc-authoring-1016 ai-usage: ai-assisted@@ -34,12 +34,12 @@ monikers: [] item_type: Content source_path: defender-for-cloud-apps/app-governance-visibility-insights-view-apps.md cmProducts:-- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/1433a524-c01f-4b87-beab-670c040dea4f - https://authoring-docs-microsoft.poolparty.biz/devrel/1dd701e0-441f-4b0a-9806-aa47decc4e35+- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/1433a524-c01f-4b87-beab-670c040dea4f - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/57eae307-c3a1-4cac-b645-1a899934bac8 spProducts:-- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/312f1f05-a431-4193-8a4d-e6245d5966de - https://authoring-docs-microsoft.poolparty.biz/devrel/0a2fc935-5977-4aa6-9f55-0be03bd2acb8+- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/312f1f05-a431-4193-8a4d-e6245d5966de - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/ee561821-1ac7-45a8-9409-6ba5eb7a5b97 platformId: 40de39e6-0254-aa47-9292-908c5f3e23fe ---@@ -58,22 +58,24 @@ Your sign-in account must have one of the [required app governance roles](app-go
For a summary of apps in your tenant, in Microsoft 365, go to **Cloud app > App governance** and select any of the apps tabs.
-By default, the app governance page sorts the grid alphabetically, by **App name**. To sort the list by another attribute, select the column name. You can also select **Search** to search for an app by name.
+By default, the app governance page sorts the grid alphabetically, by **Display name**. To sort the list by another attribute, select the column name. You can also select **Search** to search for an app by name.
-[](media/app-governance-visibility-insights-view-apps/app-governance-app-list-view.png#lightbox)
+[](media/app-governance-visibility-insights-view-apps/app-governance-app-list-view.png#lightbox)
On the **Microsoft 365** tab, the apps in your tenant are listed with the following details:
| Column name | Description |
| --- | --- |
-| **App name** | The display name of the app as registered on Microsoft Entra ID |
-| **App status** | Shows whether the app is enabled or disabled, and if disabled by whom |
+| **Display name** | The display name of the app as registered on Microsoft Entra ID |
+| **Status** | Shows whether the app is enabled or disabled, and if disabled by whom |
+| **Risk score** | Shows the identity risk score (1-100). Higher values indicate greater risk. |
| **Graph API access** | Shows whether the app has at least one Graph API permission |
| **Permission type** | Shows the app's permission type: <br>- **Delegated**: Delegated API permissions only, no roles.<br>- **Application**: Application API permissions only, no roles.<br>- **Microsoft Entra roles**: Microsoft Entra roles only, no API permissions.<br>- **Mixed**: A combination of any two or more of the above.<br>- **None**: No API permissions or Entra roles assigned. |
-| **App origin** | Shows whether the app originated within the tenant or was registered in an external tenant |
+| **Origin** | Shows whether the app originated within the tenant or was registered in an external tenant |
| **Consent type** | Shows whether the app consent is given at the user or the admin level, and the number of users whose data is accessible to the app |
| **Publisher** | Publisher of the app and their verification status |
| **Last used** | Shows the last time when the app signed in. Tracking of this data goes back to June, 2022. |
+| **Used by AI Agents (Preview)** | Shows the AI agents that use this identity to authenticate and access Microsoft 365 resources. If the value is **N/A**, agent details are unavailable, but the identity might still be used by AI agents. |
| **Last modified** | Date and time when registration information was last updated on Microsoft Entra ID |
| **Added on** | Shows the date and time when the app was registered to Microsoft Entra ID and assigned a service principal |
| **Permission usage** | Shows whether the app has any unused Graph API permissions in the last 90 days |
@@ -83,7 +85,7 @@ On the **Microsoft 365** tab, the apps in your tenant are listed with the follow | **App ID** | The app ID |
| **Sensitivity label accessed** | Sensitivity labels on content accessed by the app |
| **Service accessed** | Microsoft 365 services accessed by the app |
-| **Community use** | Shows how popular the app is across all your users (*common*, *uncommon*, *rare*) |
+| **Community use** | Shows how popular the app is among all your users (*common*, *uncommon*, *rare*) |
| **Consent grants** | Shows all app consent grants in the last 30 days |
| **App activities** | Shows all app activities in the last 30 days |
@@ -103,10 +105,6 @@ The **Summary** tab shows more data about the app, such as the date first consen
The **Risk score** tab shows a 1-100 risk score for the app, where higher values mean greater risk. The risk score helps you quickly prioritize which apps need attention first. The **Risk score** tab also shows the risk summary, including the factors behind the app's risk score.
-Note
-
-The Risk score tab is available only for OAuth apps registered in Microsoft Entra ID.
-
[](media/app-governance-visibility-insights-view-apps/app-governance-app-risk-score.png#lightbox)
### Review app connections on the Graph tab
@@ -155,7 +153,7 @@ The **Sensitivity labels** tab shows how frequently items with certain sensitivi
## Manage Google Workspace and Salesforce OAuth apps
-If you enable the [Google Workspace](connect-google-workspace) or [Salesforce](connect-salesforce) connector, you can use the **App governance** page to view information about app permissions in apps connected to Google Workspace and Salesforce. You can view the permissions granted to each app and revoke or block apps as needed.
+Enable the [Google Workspace](connect-google-workspace) or [Salesforce](connect-salesforce) connector to view connected app permissions on the **App governance** page. For Salesforce, the inventory includes both Connected Apps and External Client Apps (ECAs). You can view the permissions granted to each app and revoke or block apps as needed.
On the **App governance** page, select the **Google apps** or **Salesforce apps** tabs to view your apps. For example:
@@ -170,7 +168,7 @@ To manage your Google Workspace or Salesforce apps on the **App governance** pag | **New policy from search** | Select to create a new OAuth app policy based on the current query results, For more information, see [Create app policies in app governance](app-governance-app-policies-create). |
| **Export** | Select to export the currently listed apps to a CSV file. |
-### View Google Workforce and Salesforce OAuth app details
+### View Google Workspace and Salesforce OAuth app details
The **Google** and **Salesforce** pages provide the following information about each OAuth app that users grant permissions to:
@@ -179,15 +177,16 @@ The **Google** and **Salesforce** pages provide the following information about | **Name** | The app's name. Select to show or hide more details about the app. |
| **Authorized by** | The number of users who authorized this app to access their app's account, and granted the app permissions. Select to view more information, including a list of user emails and whether an admin previously consented to the app. On the **Users who added...** pane, select **Export** to export the listed users to a CSV file. |
| **Permission level** | *High*, *Medium*, or *Low*. The level indicates how much access this app has to the app's data. For example, *Low* might indicate that the app only accesses user profile and name. Select the level to view more information, including permissions granted to the app, community use, or related activity in the [Governance log](/en-us/defender-cloud-apps/governance-actions). |
-| **Last authorized** | The most recent date on which a user granted permissions to this app. This information is available for Salesforce only. |
+| **Last used** | The most recent date on which this app was used by anyone in your organization. |
+| **Risk score** | The app's risk score from 1 through 100. Higher values indicate greater risk. |
| **Actions** | Select an option to mark an app as approved or banned. |
Select **Show details** at the top right to view more information about all of the apps displayed, including:
| Column name | Description |
| --- | --- |
-| **Permissions** | A list of all permissions currently granted to the app. Available for Google Workspace and Salesforce (Preview). |
-| **Community use** | Common, Uncommon, Rare. Indicates how popular the app is across all your users. |
+| **Permissions** | A list of all permissions currently granted to the app. |
+| **Community use** | *Common*, *Uncommon*, or *Rare*. Indicates how popular the app is among all your users. |
| **App ID** | The app's ID |
| **App activities** | A link to the app's activity log, which you can use to understand the app's recent usage. |
-| **Last used** | The most recent date on which this app was used by anyone in your organization. This information is available for Salesforce only. |\ No newline at end of file+| **Last used** | The most recent date on which this app was used by anyone in your organization. |\ No newline at end of file