Get-EntraAppConsentReport

<#
.SYNOPSIS
    Reports OAuth consent grants across enterprise applications.

.DESCRIPTION
    Lists every OAuth2 permission grant in the tenant with the app it
    belongs to, the scopes granted, and whether consent was given by a
    user or an admin, so overprivileged third party app access is easy
    to spot.

.EXAMPLE
    .\Get-EntraAppConsentReport.ps1

.NOTES
    Requires Microsoft.Graph.Applications with an active Connect-MgGraph
    session and DelegatedPermissionGrant.Read.All scope.

.AUTHOR
    Shehryar Hassan
#>

$grants = Get-MgOauth2PermissionGrant -All

$report = foreach ($grant in $grants) {
    $sp = Get-MgServicePrincipal -ServicePrincipalId $grant.ClientId
    [pscustomobject]@{
        AppName     = $sp.DisplayName
        ConsentType = $grant.ConsentType
        Scopes      = $grant.Scope
        HighRisk    = $grant.Scope -match "Directory.ReadWrite|Mail.ReadWrite|Files.ReadWrite.All"
    }
}

$report | Sort-Object HighRisk -Descending | Format-Table -AutoSize
Write-Warning "$(($report | Where-Object HighRisk).Count) grant(s) include high risk scopes."