{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-146-account-for-skipped-graph-only-conditions-in-oauth-app-policies/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-146-account-for-skipped-graph-only-conditions-in-oauth-app-policies/", "slug": "dse-20260909-146-account-for-skipped-graph-only-conditions-in-oauth-app-policies", "url": "https://update.dsesecurity.com/updates/dse-20260909-146-account-for-skipped-graph-only-conditions-in-oauth-app-policies/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-146-account-for-skipped-graph-only-conditions-in-oauth-app-policies.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-146-account-for-skipped-graph-only-conditions-in-oauth-app-policies/" }, "title": "Account for skipped Graph-only conditions in OAuth app policies", "summary": "What happens to Graph-only conditions when app governance evaluates an app using only non-Graph APIs?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:29:30+00:00", "modified_at": "2026-09-10T00:52:39+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 246, "potentially_affected": "Custom Microsoft Entra OAuth app-governance policies whose app population includes non-Graph-only applications.", "dse_recommendation": "Review condition applicability for each API population before interpreting a custom app policy as one uniform test.", "primary_source": { "name": "Create and manage OAuth app policies with app governance - Microsoft Defender for Cloud Apps | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-cloud-apps/app-governance-app-policies-create", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

App governance skips Graph-only policy conditions for applications that access only non-Graph APIs, then evaluates the other conditions. Examples marked Graph only include application or delegated permissions, API access volume and error rate. The normal policy rule requires all specified conditions for an alert, so the documented applicability exception matters. Audit mode evaluates policies without performing configured actions. Microsoft Learn.

\n

Applicability

\n

Use this review for custom Microsoft Entra OAuth app policies spanning different API permission sets. The question is which conditions actually participate, not whether a skipped condition proves the app passed that test.

\n

DSE recommendation

\n

Review condition applicability for each API population before interpreting a custom app policy as one uniform test. Have the policy owner identify the Graph-only conditions and explain the remaining decision for non-Graph-only apps. Split the documented review cases where necessary so an alert or its absence can be understood against the applicable conditions. Keep automatic disablement out of the initial experiment.

\n

Verification

\n

In audit mode, inspect representative authorized apps with Graph access and with only non-Graph access. Compare the applicable conditions and resulting alerts with the intended policy question. Record skipped conditions explicitly instead of labeling them satisfied or failed. Before activating actions, require a reviewer to confirm that each in-scope API population has an understood decision path. Retain the app permission evidence and policy version; this test is not proof that all app behavior is benign.

\n

Official references

\n

Microsoft Learn: Custom OAuth app policies. Source reviewed September 9, 2026.

", "content_text": "Source facts\nApp governance skips Graph-only policy conditions for applications that access only non-Graph APIs, then evaluates the other conditions. Examples marked Graph only include application or delegated permissions, API access volume and error rate. The normal policy rule requires all specified conditions for an alert, so the documented applicability exception matters. Audit mode evaluates policies without performing configured actions. Microsoft Learn.\nApplicability\nUse this review for custom Microsoft Entra OAuth app policies spanning different API permission sets. The question is which conditions actually participate, not whether a skipped condition proves the app passed that test.\nDSE recommendation\nReview condition applicability for each API population before interpreting a custom app policy as one uniform test. Have the policy owner identify the Graph-only conditions and explain the remaining decision for non-Graph-only apps. Split the documented review cases where necessary so an alert or its absence can be understood against the applicable conditions. Keep automatic disablement out of the initial experiment.\nVerification\nIn audit mode, inspect representative authorized apps with Graph access and with only non-Graph access. Compare the applicable conditions and resulting alerts with the intended policy question. Record skipped conditions explicitly instead of labeling them satisfied or failed. Before activating actions, require a reviewer to confirm that each in-scope API population has an understood decision path. Retain the app permission evidence and policy version; this test is not proof that all app behavior is benign.\nOfficial references\nMicrosoft Learn: Custom OAuth app policies. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nApp governance skips Graph-only policy conditions for applications that access only non-Graph APIs, then evaluates the other conditions. Examples marked Graph only include application or delegated permissions, API access volume and error rate. The normal policy rule requires all specified conditions for an alert, so the documented applicability exception matters. Audit mode evaluates policies without performing configured actions. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-cloud-apps/app-governance-app-policies-create).\n\n## Applicability\n\nUse this review for custom Microsoft Entra OAuth app policies spanning different API permission sets. The question is which conditions actually participate, not whether a skipped condition proves the app passed that test.\n\n## DSE recommendation\n\nReview condition applicability for each API population before interpreting a custom app policy as one uniform test. Have the policy owner identify the Graph-only conditions and explain the remaining decision for non-Graph-only apps. Split the documented review cases where necessary so an alert or its absence can be understood against the applicable conditions. Keep automatic disablement out of the initial experiment.\n\n## Verification\n\nIn audit mode, inspect representative authorized apps with Graph access and with only non-Graph access. Compare the applicable conditions and resulting alerts with the intended policy question. Record skipped conditions explicitly instead of labeling them satisfied or failed. Before activating actions, require a reviewer to confirm that each in-scope API population has an understood decision path. Retain the app permission evidence and policy version; this test is not proof that all app behavior is benign.\n\n## Official references\n\n[Microsoft Learn: Custom OAuth app policies](https://learn.microsoft.com/en-us/defender-cloud-apps/app-governance-app-policies-create). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-146-account-for-skipped-graph-only-conditions-in-oauth-app-policies/", "url": "https://update.dsesecurity.com/updates/dse-20260909-146-account-for-skipped-graph-only-conditions-in-oauth-app-policies/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-146-account-for-skipped-graph-only-conditions-in-oauth-app-policies/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Account for skipped Graph-only conditions in OAuth app policies", "item": "https://update.dsesecurity.com/updates/dse-20260909-146-account-for-skipped-graph-only-conditions-in-oauth-app-policies/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-146-account-for-skipped-graph-only-conditions-in-oauth-app-policies/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-146-account-for-skipped-graph-only-conditions-in-oauth-app-policies/", "url": "https://update.dsesecurity.com/updates/dse-20260909-146-account-for-skipped-graph-only-conditions-in-oauth-app-policies/", "headline": "Account for skipped Graph-only conditions in OAuth app policies", "description": "What happens to Graph-only conditions when app governance evaluates an app using only non-Graph APIs?", "abstract": "What happens to Graph-only conditions when app governance evaluates an app using only non-Graph APIs?", "articleBody": "Source facts\nApp governance skips Graph-only policy conditions for applications that access only non-Graph APIs, then evaluates the other conditions. Examples marked Graph only include application or delegated permissions, API access volume and error rate. The normal policy rule requires all specified conditions for an alert, so the documented applicability exception matters. Audit mode evaluates policies without performing configured actions. Microsoft Learn.\nApplicability\nUse this review for custom Microsoft Entra OAuth app policies spanning different API permission sets. The question is which conditions actually participate, not whether a skipped condition proves the app passed that test.\nDSE recommendation\nReview condition applicability for each API population before interpreting a custom app policy as one uniform test. Have the policy owner identify the Graph-only conditions and explain the remaining decision for non-Graph-only apps. Split the documented review cases where necessary so an alert or its absence can be understood against the applicable conditions. Keep automatic disablement out of the initial experiment.\nVerification\nIn audit mode, inspect representative authorized apps with Graph access and with only non-Graph access. Compare the applicable conditions and resulting alerts with the intended policy question. Record skipped conditions explicitly instead of labeling them satisfied or failed. Before activating actions, require a reviewer to confirm that each in-scope API population has an understood decision path. Retain the app permission evidence and policy version; this test is not proof that all app behavior is benign.\nOfficial references\nMicrosoft Learn: Custom OAuth app policies. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:29:30+00:00", "dateModified": "2026-09-10T00:52:39+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-146-account-for-skipped-graph-only-conditions-in-oauth-app-policies/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-146-account-for-skipped-graph-only-conditions-in-oauth-app-policies/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Account for skipped Graph-only conditions in OAuth app policies" }, "articleSection": [ "Cybersecurity" ], "keywords": [ "Cybersecurity", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" } ], "wordCount": 246, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Create and manage OAuth app policies with app governance - Microsoft Defender for Cloud Apps | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-cloud-apps/app-governance-app-policies-create" } } ] } }