What it works with
Module: Microsoft.Graph.Authentication
Context: PowerShell 7 · Microsoft Graph · Microsoft Entra applications
Compatibility: PowerShell 7 is the supported target for this Microsoft Graph Entra template.
POWERSHELL / MICROSOFT.GRAPH.AUTHENTICATION
ProAdvancedRead-onlylow
Export enterprise application API permissions and consent grants
Exports application permissions and delegated OAuth consent grants for Microsoft Entra service principals, resolving resource APIs and permission names where directory metadata is available.
Pro generation after license validation · Review before running · No tenant access
What this PowerShell script does
Exports application permissions and delegated OAuth consent grants for Microsoft Entra service principals, resolving resource APIs and permission names where directory metadata is available.
Requirements
- CSV output path - Example: C:\Temp\entra-report.csv
Environment
- Module: Microsoft.Graph.Authentication
- Permissions: Directory.Read.All
- Output: CSV report
- Context: PowerShell 7 · Microsoft Graph
- Risk: Low
Review before you run Review the generated PowerShell and scope before running it.
OPS / WORKSPACE
Ready to generate
Configure Export enterprise application API permissions and consent grants in the Builder, review the generated PowerShell and run it in your own environment.
Why use this template?
Use this report to audit application permissions and delegated OAuth consent across enterprise applications. Application permissions and delegated scopes are labeled separately with client and resource identifiers, and the script never grants, revokes or changes consent.
The template uses Microsoft.Graph.Authentication and requires Directory.Read.All. Output: CSV report. Level: Advanced. Action: Read-only. Risk: Low.
Review before running
Directory.Read.All is a broad delegated read scope. Review that permission before consent, expect larger tenants to take longer because app-role assignments are read per service principal, and protect the resulting permission inventory.
Generate the script
- Open the template in the PowerShell Builder.
- Enter the requested values and review the module, permissions, output and risk.
- Generate the script, read it carefully, and test it outside production before use.
For Pro templates, only the configuration values needed by this template are sent to Opselith after license validation. The script source remains server-side until generation.
Generate Export enterprise application API permissions and consent grants →OPS / SCRIPT DETAILS
Script details
Exports application permissions and delegated OAuth consent grants for Microsoft Entra service principals, resolving resource APIs and permission names where the directory metadata is available. Review these details before generating or running the script.
Permissions and impact
Permissions: Directory.Read.All
Risk: Low
Execution impact: Read-only. The script inventories Microsoft Entra service-principal application permissions and delegated OAuth consent grants through Microsoft Graph without granting, revoking or changing consent.
Parameters
- CSV output path - Use a new absolute Windows CSV path, for example C:\\Temp\\entra-report.csv.
Output
Output: CSV with client/resource service-principal metadata, PermissionKind, permission ID/value/display name, ConsentType, PrincipalId, CreatedDateTime, Status and Error.
This template is part of the Pro library. The full Pro script is generated by Opselith after server-side license validation; only the configuration values needed by this template are sent for generation. No tenant connection is required. When you generate a Pro script, only the configuration values needed for that template are sent to Opselith after license validation.
Example use
Exports application permissions and delegated OAuth consent grants for Microsoft Entra service principals, resolving resource APIs and permission names where the directory metadata is available.
Enter the required values in the Builder, review the generated script and confirm the output before running it.
Before you run: Use PowerShell 7 with Microsoft.Graph.Authentication. Sign in with Directory.Read.All, understand that this is a broad directory read permission required by the documented delegated-consent listing API, choose a new CSV path and protect the resulting permission inventory.
ValidationRecorded evidenceQA reviewed
Static QAPassed
PSScriptAnalyzerPassed
Runtime testedNot yet recorded
Last validatedNot yet recorded
Runtime and community evidence change only after an external tester result is reviewed and accepted for release evidence.
Tester: report a result →Was this useful?One click. No email.