A weekend review shows a gallery CRM still holds a tenant-wide Mail.ReadWrite OAuth grant from a pilot last year. What should the security engineer do in this tenant?
Select an answer to reveal the explanation.
Short Explanation
That leftover Mail.ReadWrite grant is a master key you forgot under the mat. Revoke it on the enterprise app in your tenant—you do not need (or get) permission to delete the vendor’s app registration in their directory.
Full Explanation
OAuth permission grants on an enterprise application represent consented Graph or API permissions in the customer tenant. Security engineers review and revoke excessive grants there without deleting the multi-tenant application object owned by the vendor. Sentinel queries can discover grants but do not remove them. Client SDK samples and AZ-204-style code changes do not revoke directory-level OAuth grants.