Roles that read but cannot change
In Microsoft Entra, Global Reader is described as able to read everything a Global Administrator can but not update anything. Reports Reader can read sign-in and audit reports, and Security Reader can read security information and reports; of these three, only Global Reader is listed with the action to read OAuth 2.0 permission grants (the app consent grants). Ask your administrator to create the narrowest role that shows what you need, and to remove it afterwards.
Google Workspace
The Reports API page lists two scopes whose names end in readonly: one to view audit reports and one to view usage reports for your domain. Your administrator can run those reports and send you the export.
Native access reviews need a higher licence
Microsoft says access reviews need an Entra ID Governance subscription for member users, including reviewers, and some capabilities might work with Entra ID P2. Business Premium includes P1, and P2 comes with the Defender Suite add-ons. Audit and sign-in logs are available on the Free tier, but full risky-sign-in detail needs P2.
Why connected apps are part of the review
In August 2025, from as early as the 8th to at least the 18th, an actor used compromised tokens of a third-party application to export large volumes of Salesforce data and then searched it for secrets. The post says the issue did not stem from a flaw in Salesforce itself. A list of the apps that can reach your data, with an owner for each, is a useful first check.
- Ask for the list of connected apps.
- Name an owner for each.
- Ask who uses what nobody owns, then revoke what nobody needs, using your own admin account.
Sources and limits
- Microsoft Learn: Microsoft Entra built-in roles Checked 2026-10-12.
- Global Reader is described as "Can read everything that a Global Administrator can, but not update anything".
- Reports Reader is described as "Can read sign-in and audit reports" and Security Reader as "Can read security information and reports in Microsoft Entra ID and Office 365".
- Under Global Reader the permissions reference lists actions to read all properties of OAuth 2.0 permission grants and of service principals; the actions listed for Reports Reader cover audit logs, sign-in reports, provisioning logs and usage reports, with no OAuth 2.0 permission grant action.
- Google for Developers: Reports API authorisation Checked 2026-10-12.
- The Reports API lists the scopes admin.reports.audit.readonly, described as "View audit reports for your Google Workspace domain", and admin.reports.usage.readonly, described as "View usage reports for your Google Workspace domain".
- Microsoft Learn: Microsoft Entra licensing (updated 28 July 2026) Checked 2026-10-12.
- Access reviews need a Microsoft Entra ID Governance subscription for member users, including reviewers, and some capabilities might operate with Entra ID P2.
- Entra ID P1 is included in Microsoft 365 Business Premium, and P2 is included in the Defender Suite add-ons for Business Premium.
- Audit logs and sign-in logs are available on Entra ID Free, while full risky-sign-in detail needs P2.
- Google Cloud Threat Intelligence: data theft from Salesforce instances via Salesloft Drift Checked 2026-10-12.
- From as early as 8 August 2025 to at least 18 August 2025 an actor used compromised OAuth tokens of the Salesloft Drift third-party application to export large volumes of data from Salesforce instances.
- After the export the actor searched the data for secrets such as AWS access keys, passwords and Snowflake-related tokens.
- The post says the issue did not stem from a vulnerability in the core Salesforce platform.