Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud Apps
Cloud and workloads

Application inventory - Microsoft Defender for Cloud Apps | Microsoft Learn

29 September 2026Doc update+34 / −63 lines

In brief

The article now describes app risk scores, privilege levels, publisher information, and usage, clarifies SaaS insight definitions, and links to filtering and query guidance.

What Defender admins need to know

Administrators have clearer guidance for reviewing and prioritizing SaaS and OAuth applications in the inventory.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Application inventory - Microsoft Defender for Cloud Apps | Microsoft Learn

Protecting your SaaS ecosystem requires taking inventory of all SaaS and connected OAuth apps that are in your environment. With the increasing number of applications, having a comprehensive inventory is crucial to ensure security and compliance. The Applications page provides a centralized view of all SaaS and connected OAuth apps in your organization, enabling efficient monitoring and management.

At a glanceglance, you can see information such as app name, risk score, privilege level, publisher information, and other details for easy identification of SaaS and OAuth apps most at risk.

The Applications page includes the following tabs:

  • SaaS apps: A consolidated view of all SaaS applications in your network. This tab highlights key details, including app name, status (unprotected/protected app) and whether the app is marked as sanctioned or unsanctioned.
  • OAuth apps: A comprehensive view of OAuth apps registered on Microsoft Entra ID, Google workspaceWorkspace, and Salesforce. This tab highlights OAuth appsapp metadata, publisher info andinformation, app origin, permissions used, data accessedaccessed, and other insights.

Navigate to the Applications page

  • Add or remove columns.
  • Export the entire list in CSV format.
  • Select the number of items to show per page.
  • Apply filtersfilters.

Note

When exporting the applications list to a CSV file, a maximum of 1000 SaaS or OAuth apps are displayed.

The following image depicts the SaaS apps list: Screenshot of the applications tab in the Defender portal.

SaaS app details

At the top of Saas appthe SaaS apps tab, you can find actionable insights that allow you to quickly identify apps that need your attention and focus.attention. The following details are displayed:

  • Untagged high high-risk apps –- Shows apps that aren't tagged and have a high-risk.high risk score.
  • Untagged high high-traffic apps –- Shows apps that aren't tagged and have a high usage traffic (greater than 1 GB of data traffic).
  • Untagged GenAI apps –- Shows apps that aren't tagged and are Gen-AI based.based on generative AI.

Sort and filter the SaaS apps list

You can useUse sorting and filtering to focus the sort and filter functionalitySaaS apps list on the applications you want to get a more focused view. These controls also help you assess and manage the SaaS applications in your organization.manage. For filter descriptions and query options, see Filter and query discovered apps.

FilterDescription
App tagsSelect Sanctioned, Unsanctioned, or create custom tags to use in a customized filter.
AppFilter for specific SaaS apps.
CategoriesFilter according to

OAuth app categories.

Compliance risk factorFilter for specific standards, certifications, and compliance your app might comply with. For example: HIPAA, ISO 27001, SOC 2, and PCI-DSS.
Risk scoreFilter by a specific risk score, such as to view only risky apps.
Security risk factorFilter based on specific security measures, such as encryption at rest, multifactor authentication, and others.

OAuth Apps

details

The OAuth apps tab provides visibility into OAuth apps from Microsoft 365,Entra ID, Salesforce, and Google workspace and Salesforce.Workspace. Admins can review applications and decide to disable the apps or apply policies to monitor their behavior in their environment.

The OAuth app inventory includes the following app types:

  • Entra ID: Service principals registered in Microsoft Entra ID. These apps access resources through API permissions or Microsoft Entra role assignments.
  • Salesforce: OAuth apps connected through Salesforce. The inventory includes both Connected Apps and External Client Apps (ECAs).
  • Google Workspace: OAuth apps connected through Google Workspace. Users authorize these apps, which have varying levels of access to Google Workspace resources.

Actionable insights appear at the top of the OAuth apps tab. Select an insight to filter the list to the matching apps so you can quickly identify apps that need review.

Insight Description Available for
New apps Apps added in the last 30 days. Microsoft 365
Highly privileged apps Apps with powerful permissions that allow them to access data or change important settings. For Salesforce, includes Connected Apps and External Client Apps (ECAs) whose granted permissions are classified as High. Microsoft 365, Google Workspace, Salesforce (Preview)
Risky appsApps with a high risk score.Microsoft 365, Google Workspace, Salesforce
Unused apps Apps that haven't signed in within the last 90 days. For Salesforce, includes Connected Apps and ECAs that haven't been used for more than 90 days based on the last used date. Microsoft 365, Google Workspace, Salesforce (Preview)
Overprivileged apps Apps with unused permissions. Microsoft 365
Apps from external unverified publishers Apps that originated from an external unverified publisher tenant. Microsoft 365
Used by AI AgentsApps identified as being used by AI agent platforms.Microsoft 365

For more information on how to create app policies, see Create app policies in app governance.

The following image depictsshows the OAuth apps list:

Screenshot of the OAuth apps inventory showing Entra ID, Salesforce, and Google Workspace app types.

Sort and filter the OAuth apps list

You can apply the following filters to get a more focused view:

Column nameDescription
App nameThe display name of the app as registered on Microsoft Entra ID, or the connected app name in Google Workspace or Salesforce.
App statusShows whether the app is enabled or disabled, and if disabled by whom.
Graph API accessShows whether the app has at least one Graph API permission. (Microsoft 365 only.)
Permission typeShows whether the app has application (app only), delegated, or mixed permissions. (Microsoft 365 only.)
App originShows whether the app originated within the tenant or was registered in an external tenant.
Consent typeShows whether the app consent has been given at the user or the admin level, and the number of users whose data is accessible to the app.
PublisherPublisher of the app and their verification status.
Last usedDate and time when the app last signed in. For Microsoft 365, tracking goes back to June 2022. For Salesforce, requires Salesforce real-time event monitoring (Preview) to be enabled.
Last modifiedDate and time when registration information was last updated on Microsoft Entra ID.
Added onShows the date and time when the app was registered to Microsoft Entra ID and assigned a service principal.
Permission usageShows whether the app has any unused Graph API permissions in the last 90 days. (Microsoft 365 only.)
Data usageTotal data downloaded or uploaded by the app in the last 30 days. (Microsoft 365 only.)
Privilege levelThe app's privilege level (High, Medium, or Low). Available for Microsoft 365, Google Workspace, and Salesforce. For Salesforce, requires Salesforce real-time event monitoring (Preview) to be enabled.
CertificationIndicates if an app meets stringent security and compliance standards set by Microsoft 365 or if its publisher has publicly attested to its safety.
Sensitivity label accessedSensitivity labels on content accessed by the app. (Microsoft 365 only.)
Service accessedMicrosoft 365 services accessed by the app.
App IDThe app's unique identifier. For Salesforce, the App ID lets you pivot from a Salesforce threat detection alert directly to the matching OAuth app page.
TypeFor Salesforce, indicates whether the app is a Connected App or an External Client App (ECA). Use the Type filter to narrow the Salesforce inventory.

Tip

To see all columns, you might need to do one or more of the following steps:

  • Horizontally scroll in your web browser.
  • Narrow the width of appropriate columns.
  • Zoom out in your web browser. \ No newline at end of file Use sorting and filtering to focus the OAuth apps list on the applications you want to investigate. For the available columns and filters, see View your OAuth app details with app governance and View app insights. \ No newline at end of file