Microsoft 365 security guide
A practical, step-by-step guide for Australian businesses. Find obsolete, excessive or potentially malicious access to Microsoft 365 mailboxes, files, Teams and directory data.
Recommended method: review, classify and restrict third-party app access every three months
Third-party applications can retain ongoing access to Microsoft 365 mailboxes, OneDrive, SharePoint, Teams and organisational data. Regularly reviewing these applications helps identify obsolete, excessive or potentially malicious access.
You will generally need one of these Microsoft Entra roles:
This list includes third-party applications, Microsoft applications, service accounts and integrations added to the tenant.
Review applications that are:
Do not assume an unfamiliar application is malicious. It might support backup, email security, accounting, CRM, document signing, monitoring or another managed service.
Select an application and inspect the following areas.
Record the application name, application ID, publisher and verification status, whether users can sign in, whether user assignment is required, and who owns or manages the application.
Be aware that the Users and groups page may not show every user who has individually consented to an application.
Pay particular attention to permissions that allow an application to:
Examples that deserve careful examination include:
A permission is not automatically unsafe merely because it is powerful. Backup, migration, security and compliance products may legitimately require broad access.
Before changing an application, identify:
Classify each application as:
| Classification | Meaning |
|---|---|
| Approved | Recognised, supported and appropriately permissioned. |
| Reduce access | Required, but permissions or user assignments are excessive. |
| Disable and investigate | Unrecognised, suspicious or awaiting confirmation. |
| Remove | Confirmed as obsolete or unauthorised. |
Maintain an application register containing the owner, purpose, permissions, approval decision and next review date.
Removing an assignment is not always the same as revoking OAuth consent. Review the application’s Permissions page as well.
Microsoft notes that permissions shown under User consent cannot currently be revoked through that portal page. Those grants may require Microsoft Graph or PowerShell.
Disabling the application prevents new tokens and sign-ins while retaining its configuration for investigation.
Microsoft states that a deleted enterprise application normally remains recoverable for 30 days before permanent deletion.
For stricter environments, user consent can be disabled entirely, but this can increase administrative workload. Microsoft recommends limiting consent to verified publishers and selected low-risk permissions.
Microsoft advises that enabling the workflow can take up to one hour.
These instructions provide general security guidance and may not account for your Microsoft 365 licensing, integrations, compliance obligations or business applications. Microsoft can change portal names and menu locations without notice.
Incorrectly revoking permissions or deleting applications may cause service interruptions or data-access failures. Before making changes, document the existing configuration, confirm the business owner, assess dependencies and prepare a rollback plan. If you are uncertain about an application or permission, engage a qualified Microsoft 365 security engineer rather than removing it without investigation.
