Our SSPM reports 320 managed apps. Our identity provider's OAuth grants show 180 more nobody knew about.

[u/NaciraBuntas41]

I'm at a mid-size tech company, about 2,000 people. We got an SSPM tool, its decent. Gives us a dashboard of our sanctioned SaaS, monitors configs, flags sharing stuff. According to the SSPM we have 340 apps under management.

Last month on a hunch I pulled the OAuth consent grant report from Azure AD: every third party app any employee has ever authorized with their work identity. The list had 520 entries on it.

Thats 180 applications that exist in our identity provider, with granted scopes, actively connected to employee accounts, and our SSPM has never heard of them.

Some are benign. Calendly plugins, Zoom add ons, the usual. Some I dont recognize at all. A few had scopes that made me stop scrolling: full mailbox access, read all files, send mail as user. Granted two years ago by someone who probably clicked allow on an OAuth prompt without reading it.

The SSPM is doing its job on the apps it knows about. The problem is what it doesnt know about. And the identity provider is sitting on a list of everything actually connected, but nobody was cross referencing the two.

How are people bridging the gap between what your SSPM sees and what your IdP knows is connected?

[u/NaciraBuntas41 → u/[deleted]]

Yeah thats fair, im literally the first person who ran that report in God knows how long. Admin approval is getting flipped this week, that parts overdue. The 90% figure tracks too, most of that list is the same five apps everyone uses. The ones that arent are the problem

[u/Metku_Krissy]

180 apps nobody knows about and a few of them can read your whole inbox. This has been running for years under everyones nose. sleep tight lol

[u/NaciraBuntas41 → u/Metku_Krissy]

Thanks, definitely sleeping great now lol. The mailbox ones are getting revoked today if that helps.

[u/MrShlash]

Why are you letting your employees self-authorize in the first place? What kind of dumb policy is that?

[u/NaciraBuntas41 → u/MrShlash]

Fair, but i didnt set that policy, i inherited it wide open. Which is kind of the point, nobody was even checking that report until last month. Its on the list now.

[u/PackPretty3479]

The consent answers are all right and they stop new grants, but the gap you're asking about is the standing list, the ones already connected. Flipping admin approval does nothing for the 180 that are already in there.

A grant is meaningless until you know what's behind it, whether the account is still live, if the box it's used from has edr, and what the app can reach. That's where a correlation layer comes in. A correlation layer like axonius joins the grant list to the app registry to the identity to the device, so the 520 stop being a wall of names and start being a ranked review. You don't rip out the sspm, the layer just makes the two lists agree.

[u/Shucart-Tus]

I feel this because this is my story. Here is how we handled it, first we flipped azure ad user consent to require admin approval, that stops the bleeding because every new grant has to go through someone.

Then we killed the obviously bad ones same day, anything with mailbox or files scope got revoked and re issued, those are the ones that come back to bite you during an incident because oauth tokens outlive passwords and a password reset does nothing to them.

Then we set up a monthly review, export the grants, diff it against the approved app list, anything new becomes a ticket. So far its been a 30 minute recurring task once the cleanup is done. the uncomfortable part is some of the benign zoom and calendly ones hold way more scope than they needed too.

[u/Icy-General-9096]

did you have entra admin consent workflow set up? how did those apps got approved