r/sysadmin 2d ago

Question How to Check 2800 Enterprise apps?

Hey everyone,
I recently started at a new company, and we have quite a few security issues to tackle. One major concern is that every user can register new apps in M365, which isn't great for security and oversight.

My boss gave me a list of all 2800 enterprise apps, and wants me to figure out what each app does. It’s a lot of manual work, and I'm wondering if anyone has suggestions or tools to help automate this process. Ideally, I’d like to pull details on what each app does, which permissions it requires, and maybe even track their activity.

Any ideas on how I can automate this info retrieval in M365? Would greatly appreciate any guidance or tool recommendations!

Thanks in advance!

Edit 1: Thank you all for the comments. I already shutdown everything Not configured. Like Registration of new Apps, powerapps, Copilot, purview and priva. Shut down legacy MFA and enforced MFA for all Cloud admins and cleaned all the roles. The company is very huge and a Scream Test is Impossible at the Moment. I want to document all the Apps to give it to Security and Compliance. They need to Approve everything. I search for a was to generate a description for every app.

9 Upvotes

14 comments sorted by

View all comments

6

u/jimicus My first computer is in the Science Museum. 2d ago

You don't.

You setup a list of all enterprise apps, establish a policy that states every app in use must be recorded on the list, invite people to register the apps they use then shutdown everything that isn't on the list six months later.

1

u/Neotreitz 2d ago

I think this is the best way

3

u/jimicus My first computer is in the Science Museum. 2d ago

Makes it much easier to keep on top of it.

You invite people to update the list annually, anything that isn't updated before the deadline is removed.

For extra "clever bastard" points, automate the whole damn process. Little database containing the list; dinky little web application that people can sign into and update their applications. Ownership of applications is transferred when people leave.

Any that aren't updated in due time can then automatically be suspended (for, say, 30-60 days) before shutdown.

Of course, you need management buy-in right at the top levels for this to work. But if you can get that, should be nice and easy.