# Test app-governance access separately from OAuthAppInfo hunting access

> Does access to app-governance data in advanced hunting prove access to the corresponding Defender experiences?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-189-test-app-governance-access-separately-from-oauthappinfo-hunting-access/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:31:51+00:00
- Modified: 2026-09-17T16:46:29+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Does access to app-governance data in advanced hunting prove access to the corresponding Defender experiences?

## Potentially affected

Use this check when mapping Defender for Cloud Apps permissions into Microsoft Defender unified RBAC. Identify whether an operator needs the OAuthAppInfo hunting table, app-governance experiences, or both.

## DSE recommendation

DSE recommends writing separate access requirements for hunting and investigation workflows.

## Article

## Source facts

Microsoft states that virtually all app-governance experiences are controlled by Microsoft Entra ID roles. The documented exception is OAuthAppInfo in advanced hunting, where Defender for Cloud Apps unified RBAC permissions grant access to that table’s app-governance data. App-governance data in the unified alerts and incidents experiences remains controlled by Entra ID. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-xdr/compare-rbac-roles).

## Applicability

Use this check when mapping Defender for Cloud Apps permissions into Microsoft Defender unified RBAC. Identify whether an operator needs the OAuthAppInfo hunting table, app-governance experiences, or both.

## DSE recommendation

DSE recommends writing separate access requirements for hunting and investigation workflows. Map each requirement to its documented permission authority, and have the security access owner review the resulting assignments together. Include the exact app-governance views used by responders so a successful query does not become the only migration acceptance test.

## Verification

With an approved representative operator account, test the required hunting query and the required app-governance alert or incident view independently. Record which data is visible in each experience and compare it with the approved role design. Investigate a mismatch at the relevant permission authority before broadening access.

## Official references

[Microsoft Learn: Map existing RBAC permissions to Microsoft Defender unified RBAC permissions](https://learn.microsoft.com/en-us/defender-xdr/compare-rbac-roles). Source reviewed September 17, 2026.

## Primary reference

- Name: Map Microsoft Defender unified role-based access control (RBAC) permissions - Microsoft Defender XDR | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/defender-xdr/compare-rbac-roles
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Test app-governance access separately from OAuthAppInfo hunting access,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-189-test-app-governance-access-separately-from-oauthappinfo-hunting-access/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.