TECHNICAL REFERENCE
How MSPs should read OAuth permission evidence.
An OAuth audit should review permission type, scope, consent, publisher context, ownership, assignments, activity, credentials, and business purpose together. A single permission name rarely tells the full story.
EVIDENCE · INSIGHT · PROOF
Start with the question, then keep the evidence attached.
Finding
What was actually observed?
Means
What might it mean, and what still needs confirmation?
Do
What should the MSP and customer review next?
Worth
Scope the effort before applying the MSP’s hourly rate.
Delegated permissions let an application act within the signed-in user and granted scope. Application permissions let a service act without a signed-in user and can reach organization-wide data or operations. Risk depends on the exact permission, consent type, application design, owner, use, credentials, and compensating controls.
Record which source was read, its time window, its permission and license requirements, and whether the result is observed, partial, unknown, or unreadable.
See the application-governance workflow →Your next prospect meeting is already on the calendar.
Bring dated evidence, clear limits, and useful questions.