An application permission grants an app access to resources in a Microsoft Entra tenant, such as mail or files, without requiring a user to sign in. Its scope defines what the app can do, and an administrator typically consents to the grant. This differs from delegated permission, which lets an app act with a signed-in user’s access.
These permissions matter because an app identity with broad access can become a privileged pathway into an organization. In an attack, stolen app credentials or tokens may let an attacker use the app’s granted permissions, potentially across tenant resources. Defenders should inventory enterprise apps, grant only necessary permissions, and review consent changes and service-principal sign-in activity. Revoking a suspicious grant or credential can block misuse, though it may also disrupt the app’s legitimate functions.