{
  "standard": "OARS",
  "name": "Open App Risk Standard",
  "specVersion": "0.1.0-draft",
  "status": "Draft",
  "license": "CC-BY-4.0",
  "homepage": "https://citadel.ms",
  "repository": "https://github.com/citadelms/OARS",
  "authors": [
    {
      "name": "Khurram Chaudhary",
      "role": "Founding Author"
    }
  ],
  "attribution": "Derived from the Graph Consent Risk Framework by Khurram Chaudhary. Licensed CC BY 4.0 — attribution required.",
  "generatedAt": "2026-07-26T01:12:26.340Z",
  "datasetVersion": "0.1.0-draft",
  "count": 11,
  "byTier": {
    "critical": 1,
    "medium": 4,
    "low": 5,
    "high": 1
  },
  "permissions": [
    {
      "permission": "Application.ReadWrite.All",
      "type": "application",
      "api": "microsoft-graph",
      "rsc": false,
      "score": 81.2,
      "tier": "critical",
      "factors": {
        "privilegeDepth": "global-admin",
        "privilegeElevation": "role-assignment",
        "impersonationCapability": "directory-wide",
        "appRoleBundles": "broad-admin-role",
        "permissionType": "application",
        "permissionOperation": "manage",
        "permissionBreadth": "tenant",
        "accessPolicyModification": "group-role-edits",
        "userBreadth": "all-users",
        "dataClassification": "internal",
        "exfiltrationPotential": "tenant-export",
        "tokenPersistence": "refresh",
        "legacyApiRisk": "modern"
      },
      "breakdown": [
        {
          "id": "identity-privilege-escalation",
          "name": "Identity & Privilege Escalation",
          "raw": 140,
          "max": 140,
          "normalized": 100,
          "weight": 40,
          "weighted": 40
        },
        {
          "id": "access-surface-blast-radius",
          "name": "Access Surface & Blast Radius",
          "raw": 135,
          "max": 165,
          "normalized": 81.8,
          "weight": 30,
          "weighted": 24.55
        },
        {
          "id": "data-sensitivity-leakage",
          "name": "Data Sensitivity & Leakage",
          "raw": 80,
          "max": 120,
          "normalized": 66.7,
          "weight": 25,
          "weighted": 16.67
        },
        {
          "id": "compliance-trust-heuristics",
          "name": "Compliance & Trust Heuristics",
          "raw": 0,
          "max": 40,
          "normalized": 0,
          "weight": 5,
          "weighted": 0
        }
      ],
      "rationale": "Creates and modifies any application or service principal in the tenant, including adding credentials to existing ones. That last capability is the critical one: the application can add a certificate to any other service principal and then authenticate as it, inheriting that principal's permissions. Where a privileged application already exists, this is a direct path to tenant compromise, and it does so through ordinary configuration changes that look unremarkable in an audit log.",
      "references": [
        "https://learn.microsoft.com/en-us/graph/permissions-reference#applicationreadwriteall"
      ]
    },
    {
      "permission": "Directory.Read.All",
      "type": "application",
      "api": "microsoft-graph",
      "rsc": false,
      "score": 37.3,
      "tier": "medium",
      "factors": {
        "privilegeDepth": "none",
        "privilegeElevation": "none",
        "impersonationCapability": "none",
        "appRoleBundles": "none",
        "permissionType": "application",
        "permissionOperation": "read",
        "permissionBreadth": "tenant",
        "accessPolicyModification": "none",
        "userBreadth": "all-users",
        "dataClassification": "pii-regulated",
        "exfiltrationPotential": "tenant-export",
        "tokenPersistence": "refresh",
        "legacyApiRisk": "modern"
      },
      "breakdown": [
        {
          "id": "identity-privilege-escalation",
          "name": "Identity & Privilege Escalation",
          "raw": 0,
          "max": 140,
          "normalized": 0,
          "weight": 40,
          "weighted": 0
        },
        {
          "id": "access-surface-blast-radius",
          "name": "Access Surface & Blast Radius",
          "raw": 85,
          "max": 165,
          "normalized": 51.5,
          "weight": 30,
          "weighted": 15.45
        },
        {
          "id": "data-sensitivity-leakage",
          "name": "Data Sensitivity & Leakage",
          "raw": 105,
          "max": 120,
          "normalized": 87.5,
          "weight": 25,
          "weighted": 21.88
        },
        {
          "id": "compliance-trust-heuristics",
          "name": "Compliance & Trust Heuristics",
          "raw": 0,
          "max": 40,
          "normalized": 0,
          "weight": 5,
          "weighted": 0
        }
      ],
      "rationale": "Reads the entire directory: users, groups, applications, service principals, role assignments, and organisational configuration. It grants no ability to change anything, but it is the standard reconnaissance step before an identity attack, because it reveals exactly which accounts and applications are privileged and worth targeting.",
      "references": [
        "https://learn.microsoft.com/en-us/graph/permissions-reference#directoryreadall"
      ]
    },
    {
      "permission": "Files.ReadWrite.All",
      "type": "application",
      "api": "microsoft-graph",
      "rsc": false,
      "score": 36.8,
      "tier": "medium",
      "factors": {
        "privilegeDepth": "none",
        "privilegeElevation": "none",
        "impersonationCapability": "none",
        "appRoleBundles": "none",
        "permissionType": "application",
        "permissionOperation": "write",
        "permissionBreadth": "tenant",
        "accessPolicyModification": "none",
        "userBreadth": "all-users",
        "dataClassification": "confidential",
        "exfiltrationPotential": "sync-bulk",
        "tokenPersistence": "refresh",
        "legacyApiRisk": "modern"
      },
      "breakdown": [
        {
          "id": "identity-privilege-escalation",
          "name": "Identity & Privilege Escalation",
          "raw": 0,
          "max": 140,
          "normalized": 0,
          "weight": 40,
          "weighted": 0
        },
        {
          "id": "access-surface-blast-radius",
          "name": "Access Surface & Blast Radius",
          "raw": 105,
          "max": 165,
          "normalized": 63.6,
          "weight": 30,
          "weighted": 19.09
        },
        {
          "id": "data-sensitivity-leakage",
          "name": "Data Sensitivity & Leakage",
          "raw": 85,
          "max": 120,
          "normalized": 70.8,
          "weight": 25,
          "weighted": 17.71
        },
        {
          "id": "compliance-trust-heuristics",
          "name": "Compliance & Trust Heuristics",
          "raw": 0,
          "max": 40,
          "normalized": 0,
          "weight": 5,
          "weighted": 0
        }
      ],
      "rationale": "Read and write access to every file in every OneDrive and SharePoint site in the tenant, acting without a signed-in user and therefore without any user able to notice. Write access matters as much as read: content can be altered or destroyed, not merely copied. Bulk enumeration makes wholesale exfiltration practical rather than theoretical.",
      "references": [
        "https://learn.microsoft.com/en-us/graph/permissions-reference#filesreadwriteall"
      ]
    },
    {
      "permission": "Mail.Read",
      "type": "delegated",
      "api": "microsoft-graph",
      "rsc": false,
      "score": 14.1,
      "tier": "low",
      "factors": {
        "privilegeDepth": "none",
        "privilegeElevation": "none",
        "impersonationCapability": "none",
        "appRoleBundles": "none",
        "permissionType": "delegated",
        "permissionOperation": "read",
        "permissionBreadth": "single-user",
        "accessPolicyModification": "none",
        "userBreadth": "one",
        "dataClassification": "confidential",
        "exfiltrationPotential": "basic-read",
        "tokenPersistence": "short-lived",
        "legacyApiRisk": "modern"
      },
      "breakdown": [
        {
          "id": "identity-privilege-escalation",
          "name": "Identity & Privilege Escalation",
          "raw": 0,
          "max": 140,
          "normalized": 0,
          "weight": 40,
          "weighted": 0
        },
        {
          "id": "access-surface-blast-radius",
          "name": "Access Surface & Blast Radius",
          "raw": 20,
          "max": 165,
          "normalized": 12.1,
          "weight": 30,
          "weighted": 3.64
        },
        {
          "id": "data-sensitivity-leakage",
          "name": "Data Sensitivity & Leakage",
          "raw": 50,
          "max": 120,
          "normalized": 41.7,
          "weight": 25,
          "weighted": 10.42
        },
        {
          "id": "compliance-trust-heuristics",
          "name": "Compliance & Trust Heuristics",
          "raw": 0,
          "max": 40,
          "normalized": 0,
          "weight": 5,
          "weighted": 0
        }
      ],
      "rationale": "Reads the signed-in user's mailbox in full, including message bodies and attachments. Mail routinely contains credentials, contracts, and personal data, so sensitivity is high even though reach stops at one user. Read-only and single-user scope keep this well below the tenant-wide variants.",
      "references": [
        "https://learn.microsoft.com/en-us/graph/permissions-reference#mailread"
      ],
      "rscAlternative": "Mail.Read.Shared"
    },
    {
      "permission": "Mail.Read.Shared",
      "type": "delegated",
      "api": "exchange",
      "rsc": true,
      "score": 12.1,
      "tier": "low",
      "factors": {
        "privilegeDepth": "none",
        "privilegeElevation": "none",
        "impersonationCapability": "none",
        "appRoleBundles": "none",
        "permissionType": "delegated",
        "permissionOperation": "read",
        "permissionBreadth": "single-user",
        "accessPolicyModification": "none",
        "userBreadth": "one",
        "dataClassification": "confidential",
        "exfiltrationPotential": "basic-read",
        "tokenPersistence": "short-lived",
        "legacyApiRisk": "modern"
      },
      "breakdown": [
        {
          "id": "identity-privilege-escalation",
          "name": "Identity & Privilege Escalation",
          "raw": 0,
          "max": 140,
          "normalized": 0,
          "weight": 40,
          "weighted": 0
        },
        {
          "id": "access-surface-blast-radius",
          "name": "Access Surface & Blast Radius",
          "raw": 15,
          "max": 165,
          "normalized": 9.1,
          "weight": 30,
          "weighted": 2.73
        },
        {
          "id": "data-sensitivity-leakage",
          "name": "Data Sensitivity & Leakage",
          "raw": 45,
          "max": 120,
          "normalized": 37.5,
          "weight": 25,
          "weighted": 9.38
        },
        {
          "id": "compliance-trust-heuristics",
          "name": "Compliance & Trust Heuristics",
          "raw": 0,
          "max": 40,
          "normalized": 0,
          "weight": 5,
          "weighted": 0
        }
      ],
      "rationale": "The same read capability as Mail.Read, but constrained to explicitly assigned mailboxes through an Application Access Policy rather than reaching whatever the consenting user can see. Permission Breadth and Exfiltration Potential both take their reduced RSC values, which is the model rewarding a deliberate least-privilege choice. This entry exists to demonstrate the RSC adjustment against its unscoped equivalent.",
      "references": [
        "https://learn.microsoft.com/en-us/graph/auth-limit-mailbox-access"
      ]
    },
    {
      "permission": "Mail.Send",
      "type": "delegated",
      "api": "microsoft-graph",
      "rsc": false,
      "score": 28,
      "tier": "low",
      "factors": {
        "privilegeDepth": "none",
        "privilegeElevation": "none",
        "impersonationCapability": "delegated-send-as",
        "appRoleBundles": "none",
        "permissionType": "delegated",
        "permissionOperation": "send",
        "permissionBreadth": "single-user",
        "accessPolicyModification": "none",
        "userBreadth": "one",
        "dataClassification": "confidential",
        "exfiltrationPotential": "send-as-delivery",
        "tokenPersistence": "short-lived",
        "legacyApiRisk": "modern"
      },
      "breakdown": [
        {
          "id": "identity-privilege-escalation",
          "name": "Identity & Privilege Escalation",
          "raw": 15,
          "max": 140,
          "normalized": 10.7,
          "weight": 40,
          "weighted": 4.29
        },
        {
          "id": "access-surface-blast-radius",
          "name": "Access Surface & Blast Radius",
          "raw": 50,
          "max": 165,
          "normalized": 30.3,
          "weight": 30,
          "weighted": 9.09
        },
        {
          "id": "data-sensitivity-leakage",
          "name": "Data Sensitivity & Leakage",
          "raw": 70,
          "max": 120,
          "normalized": 58.3,
          "weight": 25,
          "weighted": 14.58
        },
        {
          "id": "compliance-trust-heuristics",
          "name": "Compliance & Trust Heuristics",
          "raw": 0,
          "max": 40,
          "normalized": 0,
          "weight": 5,
          "weighted": 0
        }
      ],
      "rationale": "Lets the application originate mail as the signed-in user. Messages carry the user's real address and pass internal authenticity checks, which makes this a well-documented phishing and business-email-compromise pivot. Audit trails attribute the message to the user rather than to the application, so the action is hard to trace after the fact. Reach is limited to the consenting user, which keeps blast radius low.",
      "references": [
        "https://learn.microsoft.com/en-us/graph/permissions-reference#mailsend"
      ]
    },
    {
      "permission": "offline_access",
      "type": "delegated",
      "api": "microsoft-graph",
      "rsc": false,
      "score": 10.2,
      "tier": "low",
      "factors": {
        "privilegeDepth": "none",
        "privilegeElevation": "none",
        "impersonationCapability": "none",
        "appRoleBundles": "none",
        "permissionType": "delegated",
        "permissionOperation": "read",
        "permissionBreadth": "self",
        "accessPolicyModification": "none",
        "userBreadth": "one",
        "dataClassification": "none",
        "exfiltrationPotential": "none",
        "tokenPersistence": "offline",
        "legacyApiRisk": "modern"
      },
      "breakdown": [
        {
          "id": "identity-privilege-escalation",
          "name": "Identity & Privilege Escalation",
          "raw": 0,
          "max": 140,
          "normalized": 0,
          "weight": 40,
          "weighted": 0
        },
        {
          "id": "access-surface-blast-radius",
          "name": "Access Surface & Blast Radius",
          "raw": 10,
          "max": 165,
          "normalized": 6.1,
          "weight": 30,
          "weighted": 1.82
        },
        {
          "id": "data-sensitivity-leakage",
          "name": "Data Sensitivity & Leakage",
          "raw": 40,
          "max": 120,
          "normalized": 33.3,
          "weight": 25,
          "weighted": 8.33
        },
        {
          "id": "compliance-trust-heuristics",
          "name": "Compliance & Trust Heuristics",
          "raw": 0,
          "max": 40,
          "normalized": 0,
          "weight": 5,
          "weighted": 0
        }
      ],
      "rationale": "Grants no data access of its own, which is why it is easy to wave through. Its risk is entirely durational: it issues refresh tokens that let an application keep acting long after the user has stopped paying attention, surviving password changes and going unnoticed in review. Its real impact is as a multiplier on whatever else the application holds, which is why it appears in several entries in combos.yaml rather than scoring highly alone.",
      "references": [
        "https://learn.microsoft.com/en-us/entra/identity-platform/scopes-oidc#the-offline_access-scope"
      ]
    },
    {
      "permission": "RoleManagement.ReadWrite.Directory",
      "type": "application",
      "api": "microsoft-graph",
      "rsc": false,
      "score": 64.6,
      "tier": "high",
      "factors": {
        "privilegeDepth": "global-admin",
        "privilegeElevation": "role-assignment",
        "impersonationCapability": "none",
        "appRoleBundles": "broad-admin-role",
        "permissionType": "application",
        "permissionOperation": "manage",
        "permissionBreadth": "tenant",
        "accessPolicyModification": "group-role-edits",
        "userBreadth": "all-users",
        "dataClassification": "internal",
        "exfiltrationPotential": "basic-read",
        "tokenPersistence": "refresh",
        "legacyApiRisk": "modern"
      },
      "breakdown": [
        {
          "id": "identity-privilege-escalation",
          "name": "Identity & Privilege Escalation",
          "raw": 100,
          "max": 140,
          "normalized": 71.4,
          "weight": 40,
          "weighted": 28.57
        },
        {
          "id": "access-surface-blast-radius",
          "name": "Access Surface & Blast Radius",
          "raw": 135,
          "max": 165,
          "normalized": 81.8,
          "weight": 30,
          "weighted": 24.55
        },
        {
          "id": "data-sensitivity-leakage",
          "name": "Data Sensitivity & Leakage",
          "raw": 55,
          "max": 120,
          "normalized": 45.8,
          "weight": 25,
          "weighted": 11.46
        },
        {
          "id": "compliance-trust-heuristics",
          "name": "Compliance & Trust Heuristics",
          "raw": 0,
          "max": 40,
          "normalized": 0,
          "weight": 5,
          "weighted": 0
        }
      ],
      "rationale": "Reads and writes directory role assignments, which includes assigning Global Administrator. An application holding this can promote any identity it controls to full tenant administration, making it equivalent to Global Administrator regardless of what other permissions it holds. There is no legitimate low-risk use of this scope.",
      "references": [
        "https://learn.microsoft.com/en-us/graph/permissions-reference#rolemanagementreadwritedirectory"
      ]
    },
    {
      "permission": "Sites.FullControl.All",
      "type": "application",
      "api": "microsoft-graph",
      "rsc": false,
      "score": 43.3,
      "tier": "medium",
      "factors": {
        "privilegeDepth": "none",
        "privilegeElevation": "none",
        "impersonationCapability": "none",
        "appRoleBundles": "none",
        "permissionType": "application",
        "permissionOperation": "manage",
        "permissionBreadth": "tenant",
        "accessPolicyModification": "group-role-edits",
        "userBreadth": "all-users",
        "dataClassification": "confidential",
        "exfiltrationPotential": "tenant-export",
        "tokenPersistence": "refresh",
        "legacyApiRisk": "modern"
      },
      "breakdown": [
        {
          "id": "identity-privilege-escalation",
          "name": "Identity & Privilege Escalation",
          "raw": 0,
          "max": 140,
          "normalized": 0,
          "weight": 40,
          "weighted": 0
        },
        {
          "id": "access-surface-blast-radius",
          "name": "Access Surface & Blast Radius",
          "raw": 135,
          "max": 165,
          "normalized": 81.8,
          "weight": 30,
          "weighted": 24.55
        },
        {
          "id": "data-sensitivity-leakage",
          "name": "Data Sensitivity & Leakage",
          "raw": 90,
          "max": 120,
          "normalized": 75,
          "weight": 25,
          "weighted": 18.75
        },
        {
          "id": "compliance-trust-heuristics",
          "name": "Compliance & Trust Heuristics",
          "raw": 0,
          "max": 40,
          "normalized": 0,
          "weight": 5,
          "weighted": 0
        }
      ],
      "rationale": "Full control of every SharePoint site collection in the tenant, including site permissions. The permission-management capability is what separates this from Files.ReadWrite.All: the application can grant continuing access to identities it chooses, establishing persistence that survives revocation of the original consent.",
      "references": [
        "https://learn.microsoft.com/en-us/graph/permissions-reference#sitesfullcontrolall"
      ]
    },
    {
      "permission": "User.Read",
      "type": "delegated",
      "api": "microsoft-graph",
      "rsc": false,
      "score": 7,
      "tier": "low",
      "factors": {
        "privilegeDepth": "none",
        "privilegeElevation": "none",
        "impersonationCapability": "none",
        "appRoleBundles": "none",
        "permissionType": "delegated",
        "permissionOperation": "read",
        "permissionBreadth": "self",
        "accessPolicyModification": "none",
        "userBreadth": "one",
        "dataClassification": "internal",
        "exfiltrationPotential": "none",
        "tokenPersistence": "short-lived",
        "legacyApiRisk": "modern"
      },
      "breakdown": [
        {
          "id": "identity-privilege-escalation",
          "name": "Identity & Privilege Escalation",
          "raw": 0,
          "max": 140,
          "normalized": 0,
          "weight": 40,
          "weighted": 0
        },
        {
          "id": "access-surface-blast-radius",
          "name": "Access Surface & Blast Radius",
          "raw": 10,
          "max": 165,
          "normalized": 6.1,
          "weight": 30,
          "weighted": 1.82
        },
        {
          "id": "data-sensitivity-leakage",
          "name": "Data Sensitivity & Leakage",
          "raw": 25,
          "max": 120,
          "normalized": 20.8,
          "weight": 25,
          "weighted": 5.21
        },
        {
          "id": "compliance-trust-heuristics",
          "name": "Compliance & Trust Heuristics",
          "raw": 0,
          "max": 40,
          "normalized": 0,
          "weight": 5,
          "weighted": 0
        }
      ],
      "rationale": "Reads the signed-in user's own profile and nothing else. There is no impersonation, no elevation, and no reach beyond the consenting user. This is the baseline scope almost every application requests and is the reference point for the low end of the scale.",
      "references": [
        "https://learn.microsoft.com/en-us/graph/permissions-reference#userread"
      ]
    },
    {
      "permission": "User.Read.All",
      "type": "application",
      "api": "microsoft-graph",
      "rsc": false,
      "score": 37.3,
      "tier": "medium",
      "factors": {
        "privilegeDepth": "none",
        "privilegeElevation": "none",
        "impersonationCapability": "none",
        "appRoleBundles": "none",
        "permissionType": "application",
        "permissionOperation": "read",
        "permissionBreadth": "tenant",
        "accessPolicyModification": "none",
        "userBreadth": "all-users",
        "dataClassification": "pii-regulated",
        "exfiltrationPotential": "tenant-export",
        "tokenPersistence": "refresh",
        "legacyApiRisk": "modern"
      },
      "breakdown": [
        {
          "id": "identity-privilege-escalation",
          "name": "Identity & Privilege Escalation",
          "raw": 0,
          "max": 140,
          "normalized": 0,
          "weight": 40,
          "weighted": 0
        },
        {
          "id": "access-surface-blast-radius",
          "name": "Access Surface & Blast Radius",
          "raw": 85,
          "max": 165,
          "normalized": 51.5,
          "weight": 30,
          "weighted": 15.45
        },
        {
          "id": "data-sensitivity-leakage",
          "name": "Data Sensitivity & Leakage",
          "raw": 105,
          "max": 120,
          "normalized": 87.5,
          "weight": 25,
          "weighted": 21.88
        },
        {
          "id": "compliance-trust-heuristics",
          "name": "Compliance & Trust Heuristics",
          "raw": 0,
          "max": 40,
          "normalized": 0,
          "weight": 5,
          "weighted": 0
        }
      ],
      "rationale": "Reads the full user profile of every account in the tenant without a signed-in user. The directory is regulated personal data — names, contact details, job titles, manager chains, office locations — and it is also the raw material for targeted social engineering, because it maps the organisation. Read-only, but the whole directory is readable in a single enumeration.",
      "references": [
        "https://learn.microsoft.com/en-us/graph/permissions-reference#userreadall"
      ]
    }
  ]
}