Start free trial
Start free trial
How-to 5 steps 3 min read Updated 11 November 2026

How to review Entra ID app registrations and their permissions

Find every app registration in Entra ID, name an owner, check its permissions and secrets, and retire what nobody needs.

Torsten Mandelkow Works with
How-to

What is an app registration review in Microsoft Entra ID?

An Entra ID app registration review is a periodic check of every application registered in your Microsoft Entra ID tenant: who owns it, which permissions it holds, and when its secrets and certificates expire. Done on a fixed cycle, it removes apps nobody needs.

In short

  • Any user can register an app by default, so the list grows without a decision anyone remembers.
  • An app with no owner cannot be justified, renewed or retired.
  • Expiring secrets and certificates stop business processes, and the date is known in advance.
  • Permissions are the risk, so review what each app can reach, not only that it exists.

Step by step

Five steps take you from an unknown list to a reviewed inventory with an owner on every app.

  1. List every registration and enterprise application

    Export app registrations and enterprise applications from the Microsoft Entra admin center, including each app's owners, creation date and last sign-in. This is the baseline you review against.

  2. Name an owner for each app

    Assign a named owner and a second owner to every app. Apps that have no owner, or only owners who have left, go to the manager of the last known owner to decide.

    Tip: Treat "no owner" as a finding in its own right, before you look at permissions.

    In Rencore:

  3. Check the permissions

    List what each app can access, with extra attention to Microsoft Graph and SharePoint Online permissions. Ask the owner to confirm each permission is still needed and remove the ones that are not.

    In Rencore:

  4. Check secrets and certificates

    List the expiry date of every client secret and certificate. Renew those needed within the next 30 days and remove credentials of apps you retire.

    In Rencore:

  5. Retire what nobody needs

    Disable apps that nobody confirms and delete them after a grace period. Record who decided, when, and what changed, then repeat on a fixed cycle.

Why app registrations pile up

Microsoft's defaults for Entra ID allow self-service application registration. Developers, power users and training exercises each add apps, and most of them stay in the tenant after the work ends.

Over time the list holds apps with no owner, secrets about to expire and permissions to SharePoint or Microsoft Graph that nobody can explain. When a person leaves, the apps they owned become orphaned, and nobody answers for them or for what they can reach.

Connectors in this How-to

Each connector page in the Rencore docs lists the objects, policies, reports and actions behind these steps.

Common questions about Entra ID app registrations

Can I not review app registrations in the Entra admin center?
Yes, and it is the right place to start. The Microsoft Entra admin center lists app registrations, shows their owners, secrets and API permissions, and lets you change them one app at a time. What it does not give you is a review process: nobody is asked on a schedule whether an app is still needed, and an app whose owner has left simply stays in the list. Plan the cycle and the owner questions yourself, or add tooling for them.
Who should own an app registration?
A named person on the team that depends on the app, plus a second owner so the app survives a departure. The owner answers three questions on every review: is the app still used, do its permissions still match what it does, and who renews its secret. An app owned only by a developer who has since left is the most common cause of both outages and permissions nobody can justify.
How often should app registrations be reviewed?
Quarterly suits most tenants, with a shorter cycle for apps that hold broad Microsoft Graph or SharePoint permissions. Secrets and certificates need their own earlier check, because an expiry is a date you already know. Review a new app after its first 90 days as well, since apps created for a test or a training exercise are the ones most likely to be forgotten.
How does Rencore help with app registrations?
Rencore Governance connects to Entra ID and inventories enterprise applications, app registrations, client secrets and certificates. It alerts owners before a secret or certificate expires, flags applications without an owner or orphaned by a leaver, and shows which applications hold SharePoint Online or Microsoft Graph permissions. It complements the Entra admin center rather than replacing it.

Last updated 11 November 2026

About the author

Torsten Mandelkow

Torsten is co-founder and CAA at Rencore. During his time as a SharePoint consultant, he always tried to improve and automate the SharePoint development process, first by creating the SharePoint Software Factory (SPSF), and later by creating the SharePoint code analysis tools, today known as SPCAF. After an intermezzo for 3 years at Microsoft, he is now part of the RENCORE team and is responsible for the further technical development of all our tools.

Related

See every app registration with its owner

We will show the Entra ID inventory, the apps without an owner and the expiry alerts in a short demo.

Request a demoGet started free
Rencore newsletter

Subscribe to our newsletter

Get the latest insights on governing Microsoft 365, Copilot and AI agents, delivered to your inbox.

Loading form