Who has which permissions?
Review the permission, consent, owner and assignment relationships the source exposes. Permission scope does not establish actual access to private content.
OAUTH APPLICATION GOVERNANCE
Know what was approved, who owns it, and what still needs investigation.
OAuth application governance connects application identity, publisher, permissions, consent, owners, users, activity, credentials, risk, and history when Microsoft 365 exposes those fields. SCOUTz keeps installed, consented, assigned, and active states separate.
EVIDENCE · INSIGHT · PROOF
What you can know before they let you in, and after.
01
Before consent
Published domain, DNS, email authentication, certificates and external evidence.
02
With read-only consent
Supported Microsoft 365 identity, app, permission, licensing and configuration evidence.
03
Never inferred
No message bodies, private files, chats or prompts. Unread is not clean.
WHAT'S NEW IN SCOUTz · OPEN BETA
Applications Center: ownership, access, licenses and trust
Give each application visible in the supported sources one profile. Applications Center brings five review questions together without claiming a complete inventory of every app a client uses.
Licenses and use
Compare observed assignments, available usage evidence and known entitlements. Missing activity or entitlement data is not proof of non-use or unlicensed use.
Does it include AI?
Distinguish an AI application from a business app whose vendor documents an AI feature. Neither category proves employee or agent activity.
What is its history?
Review the application's available history and dated evidence. A rescan is a new checkpoint, not continuous surveillance.
How far should you trust it?
Use publisher, permission, credential and risk context to guide review. The client's approved or denied decision remains separate from the observed evidence.
Shadow AI and Shadow IT—with the reason beside each app
Review apps outside the client's approved list, user-consented rather than admin-consented apps, and supported unlicensed-use signals. Public-source signals outside Microsoft 365 are listed alongside with their source and limits. These are reasons to investigate, not automatic proof of misuse.
Find what matters fast
Filter application lists by vendor, risk, your approved or denied decision, company-data permission scope and licenses. Color-coded risk is a review aid; the label and supporting evidence matter more than the color.
Honest by design: every count names its source. A check SCOUTz could not read stays “Not read”—not “none” or “all clear”. Microsoft 365 reviews use client-consented, read-only access and do not read message bodies, files, chats, documents or prompts.
What is OAuth application governance?
It is the ongoing work of inventorying connected applications, understanding permission scope and consent, assigning accountable owners, reviewing evidence of use, monitoring credentials and publisher context, and removing or constraining access only after the environment and business need are validated.
REAL APP CAPTURE · CLIENT DETAILS REMOVED
KEEP THE STATES SEPARATE
Installed
The application object exists. That alone does not prove access or use.
Consented
A permission grant exists. Scope, consent type, and business owner still matter.
Assigned
A user or group relationship is present. Assignment does not always prove activity.
Active
A supported source exposes recent use. Absence of activity evidence can still be unknown.
Your next prospect meeting is already on the calendar.
Bring dated evidence, clear limits, and useful questions.