{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-189-test-app-governance-access-separately-from-oauthappinfo-hunting-access/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-189-test-app-governance-access-separately-from-oauthappinfo-hunting-access/", "slug": "dse-20260917-189-test-app-governance-access-separately-from-oauthappinfo-hunting-access", "url": "https://update.dsesecurity.com/updates/dse-20260917-189-test-app-governance-access-separately-from-oauthappinfo-hunting-access/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-189-test-app-governance-access-separately-from-oauthappinfo-hunting-access.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-189-test-app-governance-access-separately-from-oauthappinfo-hunting-access/" }, "title": "Test app-governance access separately from OAuthAppInfo hunting access", "summary": "Does access to app-governance data in advanced hunting prove access to the corresponding Defender experiences?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:31:51+00:00", "modified_at": "2026-09-17T16:46:29+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 201, "potentially_affected": "Use this check when mapping Defender for Cloud Apps permissions into Microsoft Defender unified RBAC. Identify whether an operator needs the OAuthAppInfo hunting table, app-governance experiences, or both.", "dse_recommendation": "DSE recommends writing separate access requirements for hunting and investigation workflows.", "primary_source": { "name": "Map Microsoft Defender unified role-based access control (RBAC) permissions - Microsoft Defender XDR | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-xdr/compare-rbac-roles", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft states that virtually all app-governance experiences are controlled by Microsoft Entra ID roles. The documented exception is OAuthAppInfo in advanced hunting, where Defender for Cloud Apps unified RBAC permissions grant access to that table’s app-governance data. App-governance data in the unified alerts and incidents experiences remains controlled by Entra ID. Microsoft Learn.

\n

Applicability

\n

Use this check when mapping Defender for Cloud Apps permissions into Microsoft Defender unified RBAC. Identify whether an operator needs the OAuthAppInfo hunting table, app-governance experiences, or both.

\n

DSE recommendation

\n

DSE recommends writing separate access requirements for hunting and investigation workflows. Map each requirement to its documented permission authority, and have the security access owner review the resulting assignments together. Include the exact app-governance views used by responders so a successful query does not become the only migration acceptance test.

\n

Verification

\n

With an approved representative operator account, test the required hunting query and the required app-governance alert or incident view independently. Record which data is visible in each experience and compare it with the approved role design. Investigate a mismatch at the relevant permission authority before broadening access.

\n

Official references

\n

Microsoft Learn: Map existing RBAC permissions to Microsoft Defender unified RBAC permissions. Source reviewed September 17, 2026.

", "content_text": "Source facts\nMicrosoft states that virtually all app-governance experiences are controlled by Microsoft Entra ID roles. The documented exception is OAuthAppInfo in advanced hunting, where Defender for Cloud Apps unified RBAC permissions grant access to that table’s app-governance data. App-governance data in the unified alerts and incidents experiences remains controlled by Entra ID. Microsoft Learn.\nApplicability\nUse this check when mapping Defender for Cloud Apps permissions into Microsoft Defender unified RBAC. Identify whether an operator needs the OAuthAppInfo hunting table, app-governance experiences, or both.\nDSE recommendation\nDSE recommends writing separate access requirements for hunting and investigation workflows. Map each requirement to its documented permission authority, and have the security access owner review the resulting assignments together. Include the exact app-governance views used by responders so a successful query does not become the only migration acceptance test.\nVerification\nWith an approved representative operator account, test the required hunting query and the required app-governance alert or incident view independently. Record which data is visible in each experience and compare it with the approved role design. Investigate a mismatch at the relevant permission authority before broadening access.\nOfficial references\nMicrosoft Learn: Map existing RBAC permissions to Microsoft Defender unified RBAC permissions. Source reviewed September 17, 2026.", "content_markdown": "## Source facts\n\nMicrosoft states that virtually all app-governance experiences are controlled by Microsoft Entra ID roles. The documented exception is OAuthAppInfo in advanced hunting, where Defender for Cloud Apps unified RBAC permissions grant access to that table’s app-governance data. App-governance data in the unified alerts and incidents experiences remains controlled by Entra ID. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-xdr/compare-rbac-roles).\n\n## Applicability\n\nUse this check when mapping Defender for Cloud Apps permissions into Microsoft Defender unified RBAC. Identify whether an operator needs the OAuthAppInfo hunting table, app-governance experiences, or both.\n\n## DSE recommendation\n\nDSE recommends writing separate access requirements for hunting and investigation workflows. Map each requirement to its documented permission authority, and have the security access owner review the resulting assignments together. Include the exact app-governance views used by responders so a successful query does not become the only migration acceptance test.\n\n## Verification\n\nWith an approved representative operator account, test the required hunting query and the required app-governance alert or incident view independently. Record which data is visible in each experience and compare it with the approved role design. Investigate a mismatch at the relevant permission authority before broadening access.\n\n## Official references\n\n[Microsoft Learn: Map existing RBAC permissions to Microsoft Defender unified RBAC permissions](https://learn.microsoft.com/en-us/defender-xdr/compare-rbac-roles). Source reviewed September 17, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-189-test-app-governance-access-separately-from-oauthappinfo-hunting-access/", "url": "https://update.dsesecurity.com/updates/dse-20260917-189-test-app-governance-access-separately-from-oauthappinfo-hunting-access/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-189-test-app-governance-access-separately-from-oauthappinfo-hunting-access/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Test app-governance access separately from OAuthAppInfo hunting access", "item": "https://update.dsesecurity.com/updates/dse-20260917-189-test-app-governance-access-separately-from-oauthappinfo-hunting-access/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-189-test-app-governance-access-separately-from-oauthappinfo-hunting-access/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-189-test-app-governance-access-separately-from-oauthappinfo-hunting-access/", "url": "https://update.dsesecurity.com/updates/dse-20260917-189-test-app-governance-access-separately-from-oauthappinfo-hunting-access/", "headline": "Test app-governance access separately from OAuthAppInfo hunting access", "description": "Does access to app-governance data in advanced hunting prove access to the corresponding Defender experiences?", "abstract": "Does access to app-governance data in advanced hunting prove access to the corresponding Defender experiences?", "articleBody": "Source facts\nMicrosoft states that virtually all app-governance experiences are controlled by Microsoft Entra ID roles. The documented exception is OAuthAppInfo in advanced hunting, where Defender for Cloud Apps unified RBAC permissions grant access to that table’s app-governance data. App-governance data in the unified alerts and incidents experiences remains controlled by Entra ID. Microsoft Learn.\nApplicability\nUse this check when mapping Defender for Cloud Apps permissions into Microsoft Defender unified RBAC. Identify whether an operator needs the OAuthAppInfo hunting table, app-governance experiences, or both.\nDSE recommendation\nDSE recommends writing separate access requirements for hunting and investigation workflows. Map each requirement to its documented permission authority, and have the security access owner review the resulting assignments together. Include the exact app-governance views used by responders so a successful query does not become the only migration acceptance test.\nVerification\nWith an approved representative operator account, test the required hunting query and the required app-governance alert or incident view independently. Record which data is visible in each experience and compare it with the approved role design. Investigate a mismatch at the relevant permission authority before broadening access.\nOfficial references\nMicrosoft Learn: Map existing RBAC permissions to Microsoft Defender unified RBAC permissions. Source reviewed September 17, 2026.", "datePublished": "2026-09-17T16:31:51+00:00", "dateModified": "2026-09-17T16:46:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-189-test-app-governance-access-separately-from-oauthappinfo-hunting-access/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-189-test-app-governance-access-separately-from-oauthappinfo-hunting-access/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Test app-governance access separately from OAuthAppInfo hunting access" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 201, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Map Microsoft Defender unified role-based access control (RBAC) permissions - Microsoft Defender XDR | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-xdr/compare-rbac-roles" } } ] } }