App Governance
App Governance inventories every OAuth application and enterprise app (service principal) connected to your Microsoft 365 tenant, scores each one for risk, and surfaces the findings you should act on. Run it on demand from the App Governance page, or let your scheduled scans keep the inventory fresh.
Each scan enumerates your service principals, their delegated and application permissions, publisher status, sign-in activity and - for apps registered in your own tenant - their client secrets and certificates. Microsoft first-party apps are inventoried but never flagged just for being Microsoft.
Permission risk
Apps are scored on the permissions they hold. High- and critical-tier permissions (for example broad Mail.* or Files.* application permissions, or directory write access) raise an app's risk. Review whether each app still needs its permissions and revoke or narrow anything unused from Entra admin center > Enterprise applications > Permissions.
Publisher verification
Multi-tenant apps whose publisher has not completed Microsoft publisher verification are flagged, escalating when the app also holds high-impact permissions. Confirm the vendor's identity out of band before trusting an unverified app.
Dormant apps
An app that holds standing permission grants but has not signed in for 90+ days is dormant: standing access nobody uses. Revoke its grants or disable the service principal - re-consent takes minutes if it is ever needed again.
Consent phishing
App names that impersonate Microsoft wording, and unverified apps that many users have consented to for mail or file access, match the classic consent-phishing footprint. Verify the app is legitimate; if not, revoke the grants and reset the affected users' sessions.
Credential hygiene
For apps registered in your own tenant, App Governance inspects every client secret and certificate:
- Expired credentials still attached to a registration are flagged so you can remove the clutter that muddies rotation audits.
- Long-lived credentials with a validity longer than two years are flagged so you reissue them on a shorter, rotating schedule.
Credential expiry alerts
App Governance warns you before a credential lapses, so a secret or certificate never expires unnoticed and takes an integration down with it.
In the scan. Every scan raises an APPGOV.CRED.EXPIRING finding for any app whose client secret or certificate expires within 30 days, with the credential's name, exact expiry date and days remaining. Severity rises as the deadline approaches:
| Time until expiry | Severity |
|---|---|
| 15 to 30 days | High |
| 8 to 14 days | High |
| 7 days or fewer | Critical |
Already-expired credentials are reported by the expired-credentials rule above, never double-counted as expiring.
Proactive alerts. You do not have to wait for a scan. A scheduled sweep checks your inventory between scans and sends an alert as each credential crosses the 30-, 14- and 7-day thresholds - once per threshold, so you get a timely nudge without repeat noise. Alerts go to email and, when configured, to your Microsoft Teams channel and outbound webhooks (event app.credential.expiring).
Where to see it. The App Governance page lists every expiring credential in its own section - application, credential, expiry date, days left and severity - and each app's detail drawer shows the expiry state of its individual secrets and certificates.
Turning it on or off. Credential-expiry alerts are part of App Governance and follow that plan feature. Toggle the email and Teams notifications under Settings > Notifications (App credential expiry). They are on by default for plans that include App Governance.
To fix an expiring credential, roll a replacement secret or certificate in the Entra admin center > App registrations > Certificates & secrets, update the integration to use it, then remove the old one.
Known malicious apps
App identifiers that appear in published OAuth-abuse indicators of compromise are flagged as critical. Disable the service principal and revoke all of its grants immediately, then review sign-in and audit logs for what it accessed.