{"id":9785,"date":"2026-07-29T07:38:49","date_gmt":"2026-07-29T07:38:49","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=9785"},"modified":"2026-07-29T07:38:50","modified_gmt":"2026-07-29T07:38:50","slug":"powershell-finds-enterprise-applications-app-registrations-added-by-a-specific-user-in-an-entra-id-tenant","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/research\/powershell-finds-enterprise-applications-app-registrations-added-by-a-specific-user-in-an-entra-id-tenant","title":{"rendered":"Powershell finds Enterprise Applications \/ App Registrations added by a specific user in an Entra ID tenant"},"content":{"rendered":"\n
<#\n.SYNOPSIS\n    Finds Enterprise Applications \/ App Registrations added by a specific user in an Entra ID tenant.\n\n.DESCRIPTION\n    Connects to Microsoft Graph and reports on apps associated with a given user in two ways:\n      1. Entra ID Directory Audit Logs - \"Add application\" \/ \"Add service principal\" events\n         initiated by the user. This is the authoritative \"who added it\" record, but Entra\n         only retains these logs for a limited window (commonly ~30 days) unless exported\n         to a Log Analytics workspace \/ Sentinel.\n      2. Current Owners - cross-checks App Registrations and Enterprise Apps (Service\n         Principals) where the user is listed as an owner, since the creator is often\n         (but not always) added as an owner automatically. This works regardless of log\n         retention but is not a definitive \"added by\" record.\n\n.PARAMETER UserPrincipalName\n    UPN or email of the user to search for, e.g. kelly.hunt@alliedhealth.com.au\n\n.PARAMETER TenantId\n    Optional tenant ID or verified domain (e.g. alliedhealth.onmicrosoft.com) to target a\n    specific tenant at sign-in time, useful if you have access to multiple tenants.\n\n.PARAMETER DaysBack\n    How many days of audit log history to search. Defaults to 30 (Entra's typical retention\n    for directory audit logs without a Log Analytics export).\n\n.EXAMPLE\n    .\\Find-AppsAddedByUser.ps1 -UserPrincipalName kelly.hunt@alliedhealth.com.au -TenantId alliedhealth.onmicrosoft.com\n\n.NOTES\n    Requires the Microsoft.Graph PowerShell SDK module:\n        Install-Module Microsoft.Graph -Scope CurrentUser\n    Requires delegated permissions (consented at sign-in): AuditLog.Read.All, Application.Read.All, User.Read.All, Directory.Read.All\n    You must sign in with an account that has at least Global Reader \/ Application Administrator rights.\n#>\n\n[CmdletBinding()]\nparam(\n    [Parameter(Mandatory = $true)]\n    [string]$UserPrincipalName,\n\n    [Parameter(Mandatory = $false)]\n    [string]$TenantId,\n\n    [Parameter(Mandatory = $false)]\n    [int]$DaysBack = 30\n)\n\n$requiredScopes = @('AuditLog.Read.All', 'Application.Read.All', 'User.Read.All', 'Directory.Read.All')\n\nif (-not (Get-Module -ListAvailable -Name Microsoft.Graph.Authentication)) {\n    Write-Host \"Microsoft.Graph module not found. Installing for current user...\" -ForegroundColor Yellow\n    Install-Module Microsoft.Graph -Scope CurrentUser -Force -AllowClobber\n}\n\n$connectParams = @{ Scopes = $requiredScopes }\nif ($TenantId) { $connectParams['TenantId'] = $TenantId }\n\nWrite-Host \"Signing in to Microsoft Graph...\" -ForegroundColor Cyan\nConnect-MgGraph @connectParams | Out-Null\n\n$context = Get-MgContext\nWrite-Host \"Connected to tenant: $($context.TenantId)\" -ForegroundColor Green\n\n# Resolve the target user so we can match on both objectId and UPN in audit logs\n$targetUser = Get-MgUser -Filter \"userPrincipalName eq '$UserPrincipalName'\" -ErrorAction SilentlyContinue\nif (-not $targetUser) {\n    $targetUser = Get-MgUser -Filter \"mail eq '$UserPrincipalName'\" -ErrorAction SilentlyContinue\n}\nif (-not $targetUser) {\n    Write-Warning \"Could not resolve user '$UserPrincipalName' via Get-MgUser. Falling back to display-name text match in audit logs only.\"\n}\nelse {\n    Write-Host \"Resolved user: $($targetUser.DisplayName) ($($targetUser.Id))\" -ForegroundColor Green\n}\n\n# ---------------------------------------------------------------------------\n# 1. Directory audit log search - \"Add application\" \/ \"Add service principal\"\n# ---------------------------------------------------------------------------\nWrite-Host \"`n=== Searching audit logs for the last $DaysBack day(s) ===\" -ForegroundColor Cyan\n\n$startDate = (Get-Date).AddDays(-$DaysBack).ToString('yyyy-MM-ddTHH:mm:ssZ')\n$activities = @('Add application', 'Add service principal', 'Add application permissions to service principal')\n\n$auditFilter = \"activityDateTime ge $startDate\"\n$auditResults = Get-MgAuditLogDirectoryAudit -Filter $auditFilter -All -ErrorAction SilentlyContinue\n\n$matchedAudits = @()\nif ($auditResults) {\n    $matchedAudits = $auditResults | Where-Object {\n        $activities -contains $_.ActivityDisplayName -and (\n            ($targetUser -and $_.InitiatedBy.User.Id -eq $targetUser.Id) -or\n            ($_.InitiatedBy.User.UserPrincipalName -eq $UserPrincipalName) -or\n            ($_.InitiatedBy.User.DisplayName -match [regex]::Escape($UserPrincipalName))\n        )\n    }\n}\n\nif ($matchedAudits.Count -eq 0) {\n    Write-Host \"No matching 'Add application' \/ 'Add service principal' audit events found in the last $DaysBack days.\" -ForegroundColor Yellow\n    Write-Host \"(Entra audit log retention is short by default - widen -DaysBack won't help beyond the tenant's actual retention window.)\" -ForegroundColor Yellow\n}\nelse {\n    $auditReport = $matchedAudits | ForEach-Object {\n        [PSCustomObject]@{\n            DateTime     = $_.ActivityDateTime\n            Activity     = $_.ActivityDisplayName\n            TargetName   = ($_.TargetResources | Select-Object -First 1).DisplayName\n            TargetType   = ($_.TargetResources | Select-Object -First 1).Type\n            TargetAppId  = ($_.TargetResources | Select-Object -First 1).Id\n            InitiatedBy  = $_.InitiatedBy.User.UserPrincipalName\n        }\n    }\n    $auditReport | Sort-Object DateTime -Descending | Format-Table -AutoSize\n}\n\n# ---------------------------------------------------------------------------\n# 2. Cross-check: current owners of App Registrations and Enterprise Apps\n# ---------------------------------------------------------------------------\nWrite-Host \"`n=== Cross-checking current App Registration \/ Enterprise App owners ===\" -ForegroundColor Cyan\n\n$ownedApps = @()\n$ownedSPs  = @()\n\nif ($targetUser) {\n    $ownedObjects = Get-MgUserOwnedObject -UserId $targetUser.Id -All -ErrorAction SilentlyContinue\n    $ownedApps = $ownedObjects | Where-Object { $_.AdditionalProperties['@odata.type'] -eq '#microsoft.graph.application' }\n    $ownedSPs  = $ownedObjects | Where-Object { $_.AdditionalProperties['@odata.type'] -eq '#microsoft.graph.servicePrincipal' }\n}\n\nif ($ownedApps.Count -eq 0 -and $ownedSPs.Count -eq 0) {\n    Write-Host \"No App Registrations or Enterprise Apps found where this user is a current owner.\" -ForegroundColor Yellow\n}\nelse {\n    if ($ownedApps.Count -gt 0) {\n        Write-Host \"`nApp Registrations owned by $($targetUser.DisplayName):\" -ForegroundColor Green\n        $ownedApps | ForEach-Object {\n            [PSCustomObject]@{\n                DisplayName = $_.AdditionalProperties['displayName']\n                AppId       = $_.AdditionalProperties['appId']\n                Id          = $_.Id\n            }\n        } | Format-Table -AutoSize\n    }\n    if ($ownedSPs.Count -gt 0) {\n        Write-Host \"`nEnterprise Apps (Service Principals) owned by $($targetUser.DisplayName):\" -ForegroundColor Green\n        $ownedSPs | ForEach-Object {\n            [PSCustomObject]@{\n                DisplayName = $_.AdditionalProperties['displayName']\n                AppId       = $_.AdditionalProperties['appId']\n                Id          = $_.Id\n            }\n        } | Format-Table -AutoSize\n    }\n}\n\n\n# ---------------------------------------------------------------------------\n# 3. Apps where the user is an assigned user (Enterprise Apps > Users and groups)\n# ---------------------------------------------------------------------------\nWrite-Host \"`n=== Apps where $UserPrincipalName is an assigned user ===\" -ForegroundColor Cyan\n\nif ($targetUser) {\n    $assignments = Get-MgUserAppRoleAssignment -UserId $targetUser.Id -All -ErrorAction SilentlyContinue\n    if (-not $assignments -or $assignments.Count -eq 0) {\n        Write-Host \"No direct app role assignments found for this user.\" -ForegroundColor Yellow\n    }\n    else {\n        $assignments | ForEach-Object {\n            [PSCustomObject]@{\n                AppName       = $_.ResourceDisplayName\n                ResourceId    = $_.ResourceId\n                AppRoleId     = $_.AppRoleId\n                AssignedOn    = $_.CreatedDateTime\n                PrincipalType = $_.PrincipalType\n            }\n        } | Sort-Object AppName | Format-Table -AutoSize\n    }\n}\nelse {\n    Write-Warning \"Skipping assigned-apps check - user could not be resolved.\"\n}\n\nWrite-Host \"`nDone. Disconnecting from Microsoft Graph.\" -ForegroundColor Cyan\nDisconnect-MgGraph | Out-Null\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-9785","post","type-post","status-publish","format-standard","hentry","category-research"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t