Brandon Phipps
A scheduling tool, email add-in, or AI assistant may ask to connect to your Microsoft 365 account. Before anyone approves, the business should know what information the app can access, why it needs that access, and who will review the connection later.
Ask your IT administrator to review enterprise applications in Microsoft Entra, identify existing user and administrator consent, and record each app's permissions and business owner. Compare the approved access with the job the app actually performs. Plan changes with the people who rely on the integration, then verify the result.
This review covers connected applications. File and folder sharing needs its own review, including Microsoft 365 file access before a Copilot rollout. Both matter, but they answer different questions.
Signing in establishes an identity. Consent authorizes access. A familiar sign-in screen doesn't settle whether the requested permissions fit the business task.
Microsoft distinguishes delegated access, where an app acts on behalf of a user, from application access, where software operates without a signed-in user. The same permission name can have a different reach depending on that access type. Have IT explain the actual grant in plain language before approving it.
For the owner, the useful questions are concrete: Can this app read messages? Can it change records? Can it send information? Which people or resources are affected? Ask for an answer tied to the configured integration rather than a general description of the product.
Ask staff which tools they use alongside Outlook, Teams, SharePoint, and OneDrive. Include former trial products, mobile apps, meeting tools, CRM integrations, backup services, and custom automation. A list of paid subscriptions alone can miss a free tool that still has access.
Compare those answers with the administrator's application inventory. Match the application identifier and publisher, since display names alone may be confusing. An unfamiliar entry is a reason to investigate, not proof that the app is malicious.
Keep passwords, private keys, tokens, and recovery secrets out of this worksheet. Use the approved credential system for those items.
User consent depends on the organization's policies and the permissions requested. Some requests require an administrator. Review the current tenant settings rather than assuming every employee can approve every connection.
Choose an approval process that staff can use. Tell employees where to send a request, what information to include, and who responds when a needed tool is waiting for review. Microsoft supports policies that restrict user consent, including policies for selected permissions and verified publishers. IT should assess the current configuration before changing it.
Disabling future user consent does not itself resolve existing access. Include current grants in the review and document any separate cleanup work. A verified publisher is one useful check; the business still needs to assess the purpose, requested data, and vendor terms.
Microsoft's permissions review guidance directs administrators to the selected enterprise application's Permissions area and distinguishes administrator consent from user consent. Have an authorized administrator examine both. The tools required to revoke access can differ by grant type.
Ask for a review of existing access as well as the permissions a new request would add. A vendor may introduce a feature that asks for more access than the original integration needed. Review that change before accepting it.
Separate three decisions: whether the business needs the application, whether its requested access fits that need, and whether the vendor's handling of the information is acceptable. A tool can be useful while still needing a narrower configuration.
| Review item | Evidence to keep | Decision owner |
|---|---|---|
| Business purpose | Task supported, users, and dependency | Department or business owner |
| Application identity | App ID, publisher, vendor contact | IT administrator |
| Granted access | Permission type, scope, consent record, affected resources | IT administrator |
| Data handling | Vendor retention, export, deletion, and subcontractor answers | Business reviewer |
| Change plan | Keep, narrow, investigate, or remove; dependencies and approval | Business owner with IT |
| Verification | Expected result, observed result, exceptions, next review date | Named reviewer |
Use “unknown, awaiting vendor response” when evidence is missing. Give that status a follow-up date. Avoid marking an app approved simply because no one remembers a problem.
Before a planned removal, ask the business owner what would stop. A connector may feed a daily report or synchronize records used by another team. Record the current configuration, agree on a change window, and define a test that shows the business task still works afterward.
For a suspected malicious connection, involve the incident responder promptly. Preserve available evidence and follow the response plan. Routine cleanup and incident containment can require different timing and decisions.
Revoking a grant does not retrieve information already copied elsewhere. Ask the vendor how stored information is retained and deleted, and document the answer. Microsoft also notes that consent is only one authorization mechanism. Have IT check other relevant access paths rather than treating one removed grant as proof that every route is closed.
After changes, record the action and the result. Test the intended restriction and the business workflows that should remain available. Keep unresolved items visible until a named person has checked them.
When someone leaves, identify the integrations they owned and the work those connections support. Review ownership, access, and continuing business needs alongside the Microsoft 365 employee departure checklist.
Apply the same approach when changing IT providers. The business should know which applications remain necessary, who controls them, and which vendor handles an error. Our IT provider handoff checklist helps organize that discussion.
Start with the same inventory and permission checks. Then ask what information the service receives, how it stores that information, and what actions the integration can take. Review the specific product, subscription, and configuration rather than treating every AI service alike.
If a tool can send messages or change business records, agree on the actions that need human approval and how staff will check results. Our guide to agentic AI in small business IT support discusses oversight and responsibility.
No. Confirm the business approval and the requested permissions separately. Ask IT to explain the connection before granting unfamiliar access.
Investigate the identity, owner, and dependency first. Some unfamiliar applications support legitimate work. Escalate suspected malicious access promptly through the incident process.
No. Treat vendor data retention and deletion as a separate question. Request and retain an answer about the information already held by the service.
Choose a review schedule based on data sensitivity and business use. Also trigger a review when an app requests more access, its owner leaves, the service is retired, or suspicious activity appears.
Second Star Technologies helps businesses in Bakersfield and Kern County discuss Microsoft 365 support and security needs. Bring your application list and the workflows your staff depend on. Ask for a scope that covers inventory, permission review, business approval, planned changes, and verification.
Explore our cybersecurity services and managed IT services, or request a review.
A useful business app can ask a surprisingly big question: may I connect to your Microsoft 365 account?
Before someone clicks Accept, your business needs to know what that connection allows and who is responsible for it.
Welcome to The IT Edge: Business Tech Made Simple, from Second Star Technologies. Today we're looking at the apps connected to your business email and files, and how to review them without disrupting the tools people need.
Start with a simple distinction. Signing in tells the service who you are. Granting permission tells it what it may do. A familiar Microsoft sign-in screen doesn't replace your own approval process.
Ask your IT administrator to review the applications connected through Microsoft Entra. Then compare that inventory with the tools your employees actually use. Include scheduling tools, meeting assistants, customer management systems, backup services, and old trials. A free app can still have access even when it doesn't appear on the monthly subscription bill.
For each application, write down its business purpose and name an owner. That person should be able to explain what work depends on the connection. Keep the application identifier and publisher information too, since similar names can make an inventory confusing.
Next, ask IT to explain the permissions in ordinary language. Can the application read messages? Can it change records? Can it send information? Which users or resources are involved?
Microsoft distinguishes access on behalf of a user from access that lets an application operate without a signed-in user. Those arrangements can have different reach. The useful answer is the scope of your actual configuration, rather than a general statement that a product is safe.
Give employees a clear way to request a new connection. Tell them who reviews it and what information to provide. Otherwise, a blocked tool can turn into a workaround that no one has documented. Your administrator can review the organization's consent policy and decide which requests need approval. Existing grants need a separate review.
When you find an app that appears unused, check its dependencies before routine removal. It might support a report or a synchronization job that another team still needs. Agree on a change window, record the decision, and test the work afterward.
If you suspect malicious access, bring in the incident responder promptly and follow the response plan. That situation may need faster containment than ordinary cleanup.
Remember that removing permission doesn't retrieve information the vendor already copied. Ask separately about retained data, export, and deletion. Have IT check other relevant access paths as well.
Finish with a small review log. Record the app, its owner, the access reviewed, the decision, the change made, and the result. Choose a next review date. Review again when the owner leaves, the app asks for more access, or the business stops using the service.
For a Bakersfield or Kern County business, Second Star Technologies can discuss the support scope for an application access review. Bring your app list and the workflows your staff rely on. The goal is a documented decision about access, with someone responsible for checking that the result works.
Microsoft. (n.d.). Overview of permissions and consent in the Microsoft identity platform. Microsoft Learn. https://learn.microsoft.com/en-us/entra/identity-platform/permissions-consent-overview
Microsoft. (n.d.). Configure how users consent to applications. Microsoft Learn. https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent
Microsoft. (n.d.). Review permissions granted to enterprise applications. Microsoft Learn. https://learn.microsoft.com/entra/identity/enterprise-apps/manage-application-permissions
Written by Brandon Phipps, owner of Second Star Technologies. Sources reviewed November 6, 2026.
Brandon Phipps
Brandon Phipps is the owner of Second Star Technologies in Bakersfield, California. His work includes business computer and network support, cybersecurity services, and backup and disaster recovery planning. He writes practical business technology resources for the Second Star Technologies website. Connect with Brandon on LinkedIn.
Blog posts
Brandon Phipps
.png?width=121&height=121&name=Untitled%20Design(13).png)
