In Microsoft Entra, you review an app's permissions under Enterprise apps, select the app, open Permissions, and read the Admin consent and User consent tabs. You can revoke admin-granted permissions in the portal. User-granted permissions need Microsoft Graph or PowerShell. This guide follows Microsoft's documentation.
Who can do it
Microsoft says you need an Entra account in a tenant and one of these roles: Cloud Application Administrator or Application Administrator. A service principal owner who is not an administrator can invalidate refresh tokens.
Step 1: open the app
Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator. Browse to Entra ID, then Enterprise apps, then All applications. Select the app you want to restrict.
Step 2: read the permissions
Select Permissions. The Admin consent tab shows permissions that apply to the whole organisation. The User consent tab shows permissions granted to a specific user or group. Select any permission to open its details pane.
Step 3: decide what to revoke
Ask of each permission: does the app need this to do what we use it for? Be suspicious of broad read and write access to mail, files or directory data on tools that only need a calendar or a profile name.
Microsoft says you may need to review permissions when you detect a malicious application or one that has more permissions than necessary.
Step 4: revoke
For admin consent, choose the permission, select the ellipsis for it, and select Revoke permission.
Microsoft notes you cannot revoke permissions in the User consent tab using the portal. Use Microsoft Graph API calls or PowerShell cmdlets for those. The documentation provides scripts for Microsoft Graph PowerShell and Entra PowerShell that remove delegated and application permissions for a service principal, and equivalent Graph requests. Test any script on a single app first, since removing everything can break integrations.
Step 5: stop it coming back
This step is often missed. See why revoking is not enough.
Step 6: record what you did
Keep a note: app name, permissions removed, date, reason, and the person who confirmed the business owner agreed. If the app was suspicious, keep screenshots and exported grant lists for investigation.
Other authorization to check
Microsoft also reminds admins that delegated and application permissions are not the only route to sensitive information. Entra built-in roles, Exchange role-based access control and Teams resource-specific consent can grant access too.
Cadence
Quarterly is reasonable for most organisations, and after any incident involving a connected tool.
If you find an app you cannot identify, check its publisher, when it was first consented to, and who consented. Do not delete blindly. Disable user sign-in to it first if your policy allows, watch for complaints for a day, then remove it.
Where Safeguard fits
Safeguard is not an identity governance or SaaS posture product. For your own software, it provides agent identity, policies and compliance evidence automation, which can document how access is controlled.
Quick check
Can any user grant access to an app?
That depends on your consent settings. Microsoft documents a setting for how users consent to applications, and you can restrict it.
Sources
Last reviewed: 19 October 2026.
