Test app-governance access separately from OAuthAppInfo hunting access

Source facts

Microsoft states that virtually all app-governance experiences are controlled by Microsoft Entra ID roles. The documented exception is OAuthAppInfo in advanced hunting, where Defender for Cloud Apps unified RBAC permissions grant access to that table’s app-governance data. App-governance data in the unified alerts and incidents experiences remains controlled by Entra ID. Microsoft Learn.

Applicability

Use this check when mapping Defender for Cloud Apps permissions into Microsoft Defender unified RBAC. Identify whether an operator needs the OAuthAppInfo hunting table, app-governance experiences, or both.

DSE recommendation

DSE recommends writing separate access requirements for hunting and investigation workflows. Map each requirement to its documented permission authority, and have the security access owner review the resulting assignments together. Include the exact app-governance views used by responders so a successful query does not become the only migration acceptance test.

Verification

With an approved representative operator account, test the required hunting query and the required app-governance alert or incident view independently. Record which data is visible in each experience and compare it with the approved role design. Investigate a mismatch at the relevant permission authority before broadening access.

Official references

Microsoft Learn: Map existing RBAC permissions to Microsoft Defender unified RBAC permissions. Source reviewed September 17, 2026.