App Governance
How IdentityOps monitors, scores, and surfaces risk across every app registration and service principal in your Microsoft Entra tenant.
What the Apps page shows
The Apps page lists every app registration and service principal in your tenant. Each app is assigned a composite risk score from 0 to 100, and apps are categorized by lifecycle stage so you can focus on what needs attention first.
Scores update with each scan. When something changes — a credential expires, an owner is removed, a new permission is granted — the score adjusts automatically and the change is logged.
Understanding risk scores
Every app receives a composite score from 0 to 100 based on weighted signals. The score is fully deterministic — not AI or LLM generated. Every point in the score traces directly to a computed field, so you can always understand exactly why an app scored the way it did.
Scoring signals
Risk levels
Scores are grouped into four risk levels, each with a distinct color throughout the interface.
| Level | Score range | Meaning |
|---|---|---|
| CRITICAL | 75–100 | Immediate attention required. Multiple high-severity findings. |
| WARNING | 40–74 | Moderate risk. One or more findings that should be addressed. |
| INFO | 1–39 | Low-severity findings. Informational, no urgent action needed. |
| HEALTHY | 0 | No findings detected. App is well-maintained. |
Lifecycle stages
Every app is assigned a lifecycle stage. Apps move between stages automatically as scans detect changes, and every transition is logged in the activity trail.
Risk findings
Each app receives specific findings based on what IdentityOps detects during a scan. Findings are the individual issues that contribute to the composite risk score.
If more than 10% of your app registrations are ownerless, remediation should be prioritized before Conditional Access tuning. Ownership gaps create blind spots that CA policies cannot compensate for.
Risk explanations
Every app gets a plain-English risk explanation describing why it scored the way it did and what to do about it. These are generated from deterministic templates — no LLM, no external API calls. Each sentence in the explanation traces to a specific computed field, so you can always verify the reasoning.
Actions you can take
IdentityOps is read-only — it never writes to your tenant. Actions either link you to the right place in Entra or record decisions within IdentityOps for your team's audit trail.