Apps
Discover every application connected to your tenant - including the ones users consented to without IT - and see exactly what each can read, who let it in, and whether it's still used.
Apps
The Apps screen answers a question most organizations can't: "Which third-party apps and AI tools are secretly reading our data - and who let them in?" Every OAuth consent an employee clicked, every add-in, every vendor integration and managed identity is a standing credential into your data. Most tenants have hundreds; almost none can list them, let alone say what each one reaches.
What You Can Achieve
Discover shadow IT and shadow AI
Apps arrive through user consent screens, not procurement. See every application with a foothold in your tenant - including AI tools employees connected themselves - the day it appears.
Know how each app got in - and who let it
Tenant-wide admin grant or one user's consent click? 1Security records the access channel and the first admin who consented, so accountability survives staff turnover.
Rank apps by what they can touch
An app with mail-read permissions and reach into 40,000 files is not the same risk as a calendar widget. Sort by files, users, and sensitive-data reach instead of guessing from app names.
Retire dormant integrations
Apps with no users or no activity for months keep their permissions forever. Find them and cut standing attack surface that delivers zero business value.
Access Channels - How Apps Really Get to Data
The single most important attribute of an app is not what it is but how it reaches your data. 1Security classifies every app's channel:
- Tenant-wide app - application permissions granted by an admin; reads data for everyone, no user present.
- Admin-consent delegated - an admin approved it to act on behalf of any user who signs in.
- User consent - an individual clicked "Accept". This is the shadow-IT channel - and the OAuth-phishing channel.
- License-driven - access implied by product licensing.
- Explicit grant - scoped, deliberate access to specific resources.
- None - present in the tenant, currently no data path. Still worth knowing about.
The screen also separates the five application flavors - enterprise apps, app registrations, add-ins, agents, and managed identities - and flags whether each publisher is verified.
The App List
Each row quantifies an app's real footprint: files and users it can access (external users broken out), its permission levels to files, user data, and email, sensitivity labels and sensitive info within its reach, security alerts, when it was connected and by which admin, and an activity sparkline that separates the living from the abandoned.
Filters narrow by application type, access channel, Graph permission families (files, sites, chat, directory, audit logs, and more), publisher verification, sensitive-data reach, orphaned indicators (no users, no activity for a month or a year), and security alerts. Click any app for the full drawer view of its permissions and reach.
Investigative Patterns
The OAuth-phishing triage: filter user consent + unverified publisher + file or email permissions. This is the exact pattern attackers use to turn one careless click into persistent mailbox access - review this list on a schedule, not after the incident.
- Overpowered and idle - tenant-wide channel + no activity in the last year: maximum privilege, zero use. Revoke candidates with no business pushback.
- AI with reach - application type Agent + sensitive info present, then continue in the Agents screen for knowledge-source-level detail.
- Blast radius pre-read - before approving a pending consent request, look up the app's current reach and alerts here; approve with numbers, not vibes.
Groups
See what membership in any group actually unlocks - nested members, hidden external users, and the files and sites a single group grants access to.
Licenses
Find the Microsoft 365 seats you're paying for and nobody uses - unassigned units, licenses on guests, and subscriptions drifting toward a bad renewal.