Least Privileged Report · Contoso GmbH · März 2026
MSP
Security Report
App Reg Security Report by au2mator
Generated on 12.03.2026 17:02 • Analysis period: last 30 days
Permissions
Credentials
Enterprise Apps
Azure & Dir. Roles
86
Apps Total
16
Aktiv
70
Stale
15
High Risk
15
Critical
App Name
Risk Level
Permissions
Perm Category
AzureServicePrincipal…
Critical
12
Excessive
PROD: Directory Management
Critical
11
Excessive
PROD: Cert Expiry Monitor
Critical
5
Excessive
PROD: Storage Upload Service
Critical
4
Excessive
PROD: Directory Services
Critical
6
Excessive
🏢340+ Graph Endpoints Mapped
⚡30 Min to First Report
🔒0 Extra Tools or Agents
🇦🇹Made in Austria
The Problem
Azure grows. So do the permissions. Until nobody knows what’s going on.
Every App Registration, every service principal, every new automation brings new permissions with it. After a year, nobody knows who can do what anymore. And what’s worse: nobody asks.
📈
Uncontrolled Growth
App Registrations are created and never reviewed again. Permissions accumulate. After two years, every app has too many rights that nobody feels responsible for.
⏱️
Manual Auditing is Painful
Checking everything manually takes hours and is error-prone. So it’s rarely if ever done. Until a compliance audit or security incident forces it.
🔓
Overprivilege Opens Doors
Too many permissions are an attack vector. For attackers, data breaches, and compliance violations. ISO 27001, NIS2, and GDPR have clear expectations here.
How it Works
From Deployment to Report in Under 30 Minutes.
Native Azure Automation. No agent, no VM, no new infrastructure. Just a runbook in your existing setup.
1
Deployment
A PowerShell runbook in your Azure Automation. Two App Registrations for read access. Configuration in under 30 minutes, no changes to existing systems.
2
Automated Analysis
The report scans all App Registrations, maps used API endpoints to required permissions, and classifies each app: Optimal, Excessive, Unmatched, or No Activity.
3
Report by Email
Weekly or monthly, a clear HTML report lands in your inbox. With risk classification, recommendations, and an interactive view of all App Registrations.
Live Demo
This is not a screenshot. This is a real report.
Filter by risk level, click on individual apps, explore endpoint mappings, and immediately see where action is needed.
Sample data from a real tenant. Anonymized.
au2mator LPR Demo Report
16
Aktiv
15
Excessive
15
Critical
AllCriticalHighExcessive
VeeamAzureApp…Critical
PROD: Directory ManagementCritical
PROD: Directory ServicesCritical
Features
Everything included. Nothing unnecessary. Built for Azure. For companies of any size.
The LPR uses exclusively native Azure Automation capabilities. No external data flows, no additional infrastructure, no vendor lock-in.
🎯
3-Level Permission Classification
Optimal, Excessive, and Unmatched. Every App Registration is precisely rated with concrete recommendations. No guessing, no room for interpretation.
🗺️
340+ Graph Endpoints Mapped
Complete mapping of all relevant Microsoft Graph API endpoints to the minimum required permissions. Extended with every update. Always current.
📊
Activity-Based Analysis
The report doesn’t just look at which permissions exist, but which are actually used. Stale apps with 0 API calls in 30 days are flagged separately.
⚡
Native Azure Automation
PowerShell 7.4, kein Agent, keine VM. Das Runbook läuft genau dort, wo deine Automatisierungen bereits laufen. Setup unter 30 Minuten, keine neuen Systeme.
📧
Professional HTML Report by Email
Interactive, filterable HTML view directly in your inbox. No login, no portal, no extra tool. Einfach aufmachen und lesen. Mit au2mator oder eurem eigenen Branding.
🔒
Least Privilege by Design
Zwei App Registrations mit Read-only Rechten. Keine Managed Identity, keine Owner Berechtigungen. Was der Report analysiert, lebt selbst nach demselben Prinzip.
🏷️
White-Label for MSPs
Your own logo, your colors, your domain in the report. Perfect for Managed Service Providers offering security reporting as part of their service portfolio.
🔄
Centrally Managed, Automatically Deployed
Der LPR wird von au2mator auf GitHub gehostet, gewartet und weiterentwickelt. Neue Endpoint-Mappings und Features landen per Knopfdruck bei allen Kunden — ohne manuellen Aufwand eurer Seite.
🛡️
Your Data Stays in Your Tenant
Credentials stay with you. The runbook runs in your Azure Automation. No data leaving your environment, no external access. au2mator delivers only the logic.
🇦🇹
Support and Documentation
Full documentation in German and English. Support in German and English. Built by an Austrian company working daily in the Azure mid-market environment.
🔐
Secret & Certificate Expiry Monitoring
App Registrations and Service Principals are automatically scanned for expiring secrets and certificates. Status indicator (Expired / Critical / Warning / OK) directly in the report — including expiry date and days remaining.
NEW
🗂️
4-Tab Report Navigation
The report is organized into four tabs: Permissions, Credentials, Enterprise Apps, and Azure & Directory Roles. Every tab is instantly filterable, searchable, and sortable.
NEW
🔗
Enterprise Applications (SSO) Monitoring
All SSO apps (Calendly, Zoom, Salesforce & more) at a glance: SSO mode (SAML/OIDC), last sign-in, active user count, and expiring credentials — all in a dedicated tab.
NEW
🛡️
Azure RBAC & Directory Roles
Complete overview of all service principals with Azure RBAC roles (Owner, Contributor, Reader, etc.) and Entra Directory roles (Global Admin, Attack Simulation Admin, etc.) — including high-privilege flagging.
NEW
⛔
Missing Permission Detection
When an app makes API calls and receives 403 Forbidden responses, the report shows exactly which endpoints are affected. Real data from Log Analytics — no theoretical analysis, no false positives.
NEW
🔍
Live Search & Sortable Columns
Across all four tabs: live search across all entries, sortable table columns, and KPI cards as clickable filters. Narrow down to what matters in seconds.
NEW
📋
Detail Modals for All Entries
Every row in every tab is clickable. A detail modal shows app details, risk analysis, API activity, endpoint mapping, credentials, and roles — all one click away, no new window needed.
Report Structure
What you see, what it means.
Every report contains a complete inventory of all App Registrations with risk classification, permission analysis, and concrete recommendations.
✅
Optimal
App uses exactly the permissions it actually needs. No action required.
⚠️
Excessive
App has more permissions than it uses. Clear list of what should be removed.
🔍
Unmatched
App calls endpoints that could not be matched in the permissions mapping. Requires manual review.
💤
No Activity
App had no API activity in the last 30 days. Candidate for deactivation or deletion.
We deploy, maintain, keep the report up to date, and deliver results monthly. You don’t have to worry about a thing.
✓
Setup and Deployment by au2matorWe configure everything in your Azure tenant. You just need to grant access.
✓
Monthly Report Delivered AutomaticallyOn time, complete, with concrete recommendations. Directly to your desired recipients.
✓
Updates and New Endpoint Mappings IncludedMicrosoft continuously extends Graph. We keep the mapping current, automatically.
Frequently Asked Questions
What you want to know.
The LPR requires two App Registrations: a read app for Graph permissions (Application.Read.All, User.ReadBasic.All) and a mail app for report delivery. No owner permissions, no write access, no access to mailboxes or documents.
You need an Azure Log Analytics Workspace with Entra ID Sign-in and Audit Logs enabled, plus an Entra ID P1 or P2 license. Both are required for the 30-day activity analysis. Azure Automation and an active Azure subscription are also required.
No. The runbook runs entirely within your Azure Automation in your tenant. The finished report is sent by email from your own infrastructure. No data is transferred to external au2mator systems. We never see your tenant data.
In the Managed Service, we handle the complete setup. You only need to create the two App Registrations in the Azure Portal and hand over the credentials. The rest takes under 30 minutes. The report runs fully on the first run.
Monthly by default. Weekly on request. The schedule is configured during setup and can be adjusted at any time. The analysis period is always the last 30 days of API activity from Azure Log Analytics Workspaces.
Contact Us
Ready for clear Azure permissions?
Drop us a line — we’ll discuss your Azure environment and put together a tailored offer. Free, no commitment.
MSP
