tinyurl.com
Finding App Permissions in the Entra Maze (a PoShaKucha) - Andres Bohren - PSConfEU 2026
PowerShell Conference EU June 1-4, 2026 Dorint Pallas Wiesbaden https://github.com/psconfeu/2026 (slides, code) In this PoShaKucha, Andres Bohren introduces a method for finding app permissions in Microsoft 365 and Exchange Online. He explains that the work started from a practical need to understand what has been granted through application access policies and how to extract that information in a usable form. Andres first outlines the background of the different access models. He describes application access policies in Exchange as a filter based on group membership and notes that Exchange RBAC for Applications was introduced later, with permissions handled in Exchange Online. He then frames the main task as identifying the application access policy, the app, the permission, and the distribution group, and exporting the results. He then shows how permissions appear in the Entra portal and in the application manifest. For delegated permissions, he notes that the scope can be read directly and split from a string. For application permissions, he explains that the manifest only returns IDs, so he had to map those IDs back to permission names. He says he found the relevant list by using browser developer tools and inspecting the query behind the page. Andres also explains how to retrieve the distribution group from the access policy object by using the scope identity row and splitting the value. He combines the application, permission, and group details into a PSCustomObject and exports the result to CSV. Finally, he discusses a practical issue with exporting arrays to flat files. He shows that arrays need to be joined into a string first, and suggests using a separator such as a hashtag. He also mentions replacing delimiters with line breaks for easier viewing, and concludes that the process provides a generic way to extract delegated and application permissions along with related group data. Chapters: 00:00:00 Finding App Permissions in the Entra Maze (a PoShaKucha) - Andres Bohren - PSConfEU 2026 00:00:19 Introduction and Credentials 00:01:26 Access Policy Basics 00:02:32 Permission Mapping Challenges 00:04:14 Finding Distribution Groups 00:04:53 Exporting Arrays to CSV 00:06:06 Wrapping Up and Next Steps
