|
| 1 | + |
| 2 | + |
| 3 | +# Revoke permissions for a given Azure Entra ID application registration |
| 4 | + |
| 5 | +This script demonstrates how to audit and revoke Entra ID app permissions across SharePoint sites. The script automates the process of scanning all tenant sites, generating CSV reports of app permissions, and revoking access while implementing verification steps to ensure successful removal. |
| 6 | + |
| 7 | +## Summary |
| 8 | + |
| 9 | +# [PnP PowerShell](#tab/pnpps) |
| 10 | + |
| 11 | +```powershell |
| 12 | +param ( |
| 13 | + [Parameter(Mandatory = $true)] |
| 14 | + [string] $domain, |
| 15 | + |
| 16 | + [Parameter(Mandatory = $true)] |
| 17 | + [string] $app, |
| 18 | + |
| 19 | + [Parameter(Mandatory = $false)] |
| 20 | + [switch] $RevokePermissions |
| 21 | +) |
| 22 | +
|
| 23 | +# Construct SharePoint URLs |
| 24 | +$adminSiteURL = "https://$domain-admin.sharepoint.com" |
| 25 | +$TenantURL = "https://$domain.sharepoint.com" |
| 26 | +
|
| 27 | +# Generate timestamped filename for the report |
| 28 | +$dateTime = "_{0:MM_dd_yy}_{0:HH_mm_ss}" -f (Get-Date) |
| 29 | +$invocation = (Get-Variable MyInvocation).Value |
| 30 | +$directorypath = Split-Path $invocation.MyCommand.Path |
| 31 | +$fileName = "entraid_site_permissions" + $dateTime + ".csv" |
| 32 | +$outputPath = Join-Path $directorypath $fileName |
| 33 | +
|
| 34 | +# Create output file if it doesn't exist |
| 35 | +if (-not (Test-Path $outputPath)) { |
| 36 | + New-Item -ItemType File -Path $outputPath | Out-Null |
| 37 | +} |
| 38 | +
|
| 39 | +# Connect to SharePoint Admin Center |
| 40 | +Connect-PnPOnline -Url $adminSiteURL -Interactive -WarningAction SilentlyContinue |
| 41 | +
|
| 42 | +Write-Host "Scanning sites for Entra ID app permissions..." -ForegroundColor Yellow |
| 43 | +
|
| 44 | +# Process each site in the tenant |
| 45 | +$report = Get-PnPTenantSite -Filter "Url -like '$TenantURL'" | |
| 46 | + Where-Object { $_.Template -ne 'RedirectSite#0' } | |
| 47 | + ForEach-Object { |
| 48 | + $siteUrl = $_.Url |
| 49 | + Write-Host "Processing site: $siteUrl" -ForegroundColor Cyan |
| 50 | + |
| 51 | + # Connect to the specific site |
| 52 | + Connect-PnPOnline -Url $siteUrl -Interactive -WarningAction SilentlyContinue |
| 53 | + |
| 54 | + # Get app permissions for the specified app |
| 55 | + Get-PnPAzureADAppSitePermission -AppIdentity $app | ForEach-Object { |
| 56 | + # Create report object |
| 57 | + $permissionData = [PSCustomObject]@{ |
| 58 | + PermissionId = $_.Id |
| 59 | + SiteUrl = $siteUrl |
| 60 | + Roles = $_.Roles -join "," |
| 61 | + Apps = $_.Apps -join "," |
| 62 | + DisplayName = $_.DisplayName |
| 63 | + RevokedDate = if ($RevokePermissions) { Get-Date -Format "yyyy-MM-dd HH:mm:ss" } else { "Not Revoked" } |
| 64 | + } |
| 65 | + |
| 66 | + # Revoke the permission only if the switch is enabled |
| 67 | + if ($RevokePermissions) { |
| 68 | + try { |
| 69 | + Write-Host " Revoking permission ID: $($_.Id)" -ForegroundColor Yellow |
| 70 | + Revoke-PnPEntraIDAppSitePermission -PermissionId $_.Id -Site $siteUrl -Force |
| 71 | + Write-Host " Successfully revoked permission" -ForegroundColor Green |
| 72 | + } |
| 73 | + catch { |
| 74 | + Write-Host " Error revoking permission: $($_.Exception.Message)" -ForegroundColor Red |
| 75 | + } |
| 76 | + |
| 77 | + # Verify the permission was revoked |
| 78 | + Start-Sleep -Seconds 2 |
| 79 | + $remainingPerms = Get-PnPAzureADAppSitePermission -AppIdentity $app -ErrorAction SilentlyContinue |
| 80 | + if ($remainingPerms | Where-Object { $_.Id -eq $_.Id }) { |
| 81 | + Write-Host " WARNING: Permission may still exist. Verify manually!" -ForegroundColor Red |
| 82 | + } |
| 83 | + } |
| 84 | + else { |
| 85 | + Write-Host " Found permission ID: $($_.Id) (not revoking - report only mode)" -ForegroundColor Cyan |
| 86 | + } |
| 87 | + |
| 88 | + # Return the permission data for the report |
| 89 | + $permissionData |
| 90 | + } |
| 91 | + } |
| 92 | +
|
| 93 | +# Export report to CSV |
| 94 | +$report | Export-Csv $outputPath -NoTypeInformation -Append |
| 95 | +
|
| 96 | +Write-Host "`nReport saved to: $outputPath" -ForegroundColor Green |
| 97 | +if ($RevokePermissions) { |
| 98 | + Write-Host "Permissions have been revoked. Please verify that permissions were successfully revoked." -ForegroundColor Yellow |
| 99 | +} |
| 100 | +else { |
| 101 | + Write-Host "Report-only mode: No permissions were revoked. Use -RevokePermissions switch to revoke." -ForegroundColor Yellow |
| 102 | +} |
| 103 | +``` |
| 104 | +[!INCLUDE [More about PnP PowerShell](../../docfx/includes/MORE-PNPPS.md)] |
| 105 | + |
| 106 | + |
| 107 | +## Source Credit |
| 108 | + |
| 109 | +Sample idea first appeared on [Revoke Entra ID App Permissions from SharePoint Sites Using PnP PowerShell](https://reshmeeauckloo.com/posts/powershell-sharepoint-revokeentraidpermissions/). |
| 110 | + |
| 111 | +## Contributors |
| 112 | + |
| 113 | +| Author(s) | |
| 114 | +|-----------| |
| 115 | +| [Reshmee Auckloo](https://github.com/reshmee011) | |
| 116 | + |
| 117 | + |
| 118 | +[!INCLUDE [DISCLAIMER](../../docfx/includes/DISCLAIMER.md)] |
| 119 | +<img src="https://m365-visitor-stats.azurewebsites.net/script-samples/scripts/spo-revoke-app-site-permission" aria-hidden="true" /> |
0 commit comments