Microsoft 365 and Microsoft Entra OAuth app access management
In Microsoft 365, third-party applications can be authorized against accounts in your Entra ID tenant through OAuth. The application is granted defined access, and it keeps that access until the grant is removed.
These authorizations are worth governing separately because they are held by software rather than people. They do not appear on a user list, and they are not automatically retired when an employee’s account is disabled.
Solvantra connects to Microsoft 365 through Microsoft Graph to discover those app grants and revoke them when an administrator authorises it. Current status for this and every other connector is on the integrations page.
App grants are not full Entra directory governance
Microsoft Entra ID does a great deal. Solvantra addresses one slice of it, and the boundary should not be blurred.
Entra directory and identity governance covers the authoritative identity record: user lifecycle, groups and group membership, licence assignment, Conditional Access, access reviews, privileged role management and authentication policy. That is Microsoft’s platform, administered by your team.
OAuth app grant governance covers which third-party applications hold authorizations against accounts in that tenant, and whether those authorizations should still exist.
Solvantra operates on the second. It does not manage groups, licences or Conditional Access, does not perform Entra access reviews or privileged identity management, does not act as an SSO provider, and does not replace Entra ID. It also does not manage the Entra identity lifecycle — it consumes lifecycle signals, through an HRIS termination webhook, rather than owning them.
What Solvantra discovers through Microsoft Graph
OAuth app grants
The application authorizations held against the tenant, discovered via Microsoft Graph — which applications hold access, and to which accounts.
SaaS spend from receipts (not currently enabled)
Receipt-email discovery through Microsoft Graph is implemented but is not currently enabled. It requires the Microsoft Graph Mail.Read application permission, which is not requested by the current Solvantra app registration. OAuth app grant discovery and revocation do not depend on it.
Discovered grants are analysed and flagged where they may no longer be needed, then put in front of an administrator — the workflow described on the OAuth access management page.
The revocation workflow
Revocation follows a fixed path, and an administrator controls whether the workflow is enabled and which mode it runs in.
1. Connect
Solvantra connects through Microsoft Graph using its own app registration (OAuth client credentials). An administrator supplies the organization’s Entra tenant ID.
2. Discover and flag
App grants are enumerated via Graph and analysed. Grants tied to a terminated employee, or otherwise likely to be unnecessary, are flagged with the reason attached.
3. Review
An administrator can review the flagged grants and decide which should be revoked. In Live mode, an administrator’s decision to enable the workflow authorizes automatic revocation of already-flagged grants when a termination event arrives. Dry-run shows what would be revoked first.
4. Revoke
Revocations are executed through Microsoft Graph. The application loses its authorization, and the workflow records what was acted on.
Where the trigger is an employee departure, the same workflow can be driven by a signed HRIS webhook running in Off, Dry-run or Live mode. Dry-run is the default, so the workflow can be observed before it is permitted to change anything; Live mode requires a connected revocation credential.
Limitations that apply today
- Authentication uses Solvantra’s own Microsoft Graph app registration (OAuth client credentials), with the organization’s Entra tenant ID supplied by an administrator. There is no refresh token.
- This is OAuth-grant governance, not full Entra ID directory or identity governance. There is no verified group, licence or Conditional Access management.
- Solvantra does not replace Entra ID and does not act as an SSO provider.
- Revoking a grant removes the application’s authorization; it does not delete or disable the underlying Microsoft 365 user account.
- Discovery covers OAuth-connected applications, not password-only accounts with no OAuth relationship to the tenant.
- No Microsoft 365 tenant has yet been connected in production.
Common questions
Does Solvantra replace Microsoft Entra ID?
No. Entra ID remains your identity provider and directory. Solvantra governs the OAuth application grants held against accounts in that tenant, and does not manage groups, licences, Conditional Access or the Entra identity lifecycle.
How does Solvantra connect to Microsoft 365?
Solvantra connects through Microsoft Graph using its own app registration (OAuth client credentials). An administrator supplies the organization’s Entra tenant ID. No Microsoft 365 tenant has yet been connected in production.
What happens to the user account when a grant is revoked?
Nothing. Revocation removes the third-party application’s authorization against the account. Disabling or deleting the Microsoft 365 user account is a separate administrative action in Entra ID.
Related reading
See which applications hold grants against your Microsoft 365 tenant.
Start with a free assessment, or talk to us about connecting a tenant.