How to retrieve app permissions?

[lbendlin]

We instruct our developers not to give app access to the "Entire organization"  but to specify individual email addresses and groups (PDLs).  This is working fine for a while until that access list grows so large that it is no longer maintanable  (for example you add an employee but the "update app"  fails because some other employee on the list has left the company and their email is no longer valid).  It would also be nice to be able to reduce the number of individuals and increase the use of PDLs (of course being careful not to overshare).

Has anyone found a way to retrieve the list of users and PDLs that are currently given access to a particular app? Copy&Paste does not seem to work, and I could not find any API calls around that request.

[collinq]

Hi @lbendlin ,

There is no API that I am aware of that gives you this access.  However, there is a github script that might work for you.

https://github.com/msfttimmac/MyPowerBIPowerShellSamples/blob/master/Get_AllReportsInAllWorkspaces.p...

I would appreciate Kudos if my response was helpful. I would also appreciate it if you would Mark this As a Solution if it solved the problem. Thanks!

[lbendlin]

Yeah, none of the Powershell cmdlets come anywhere close to the app object, or the permission settings, as far as I can tell.

[lbendlin · Accepted solution]

Found it.  Combine the CreateApp and UpdateApp tenant audit logs and use the OrgAppPermission of the latest CreationTime timestamp for each App ItemName.  Also shows whodunnit.