Drilldown

Give you an overview of all your appllications in Entra ID their related sign-in events

Purpose

The Applications – Drilldown report provides a detailed overview of all applications registered in Microsoft Entra ID, with a focus on actual usage.

The report helps you:

• Understand which applications are actively used

• Identify unused or inactive applications

• Track end-user sign-ins and system sign-ins (service principals / managed identities)

• Support cleanup, governance, and security reviews

By combining application metadata with sign-in activity, the report enables data-driven decisions around application lifecycle management.

---

What problem does this report solve?

Over time, Entra ID tenants accumulate applications that:

• Are no longer used

• Were created for temporary projects

• Are used only by automation or integrations

• Still have credentials, permissions, or owners assigned

This report consolidates usage signals into a single view, making it easier to:

• Detect applications that can be reviewed or decommissioned

• Distinguish between user-driven apps and system-only apps

• Reduce security risk from dormant identities

---

How to use the report

1. Use slicers to narrow down the scope

The slicer menu allows you to filter applications based on usage, ownership, and sign-in behavior.

Available slicers:

• Applications Displays the total number of applications based on the selected filters.

• Microsoft App Filter between Microsoft-owned applications and third-party / custom applications.

• Enabled Filter applications that are enabled or disabled for sign-in.

• App In Use Indicates whether the application is considered in use.

  Logic:

  • No → No user sign-ins, no system sign-ins, and no SCIM configuration

  • Yes → Used by end-users or service principals / managed identities or has SCIM configured

• User Sign-In Filter applications that have been used by end-users.

• Latest User Sign-In Filter applications based on a specific time period for end-user sign-ins.

• System Sign-In Filter applications that have been used by a service principal or managed identity.

• Application Owner Filter applications where an owner is assigned in Entra ID.

• Type Filter by service principal type (for example Application, Managed Identity, Social IdP, Legacy). Reference: https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals?tabs=browser#service-principal-object

---

2. Analyse application details

The Application Details Table shows one row per application and combines configuration data with usage data, such as:

• Application name

• Creation date

• Application owner

• Enabled status

• App in use indicator

• User count

• Last user sign-in

• Last system sign-in

• Service principal type

• Credential and SCIM information (optional via column selector)

Use the Column Selector to customize which attributes are visible depending on your review scenario.

---

Typical use cases

Identify unused applications

• Filter App In Use = No

• Combine with Enabled = Yes

• Review applications that may be candidates for cleanup

Review service principal usage

• Filter System Sign-In = Yes

• Inspect last system sign-in and service principal type

• Validate automation and integration dependencies

Validate application ownership

• Filter applications without an owner

• Identify apps that require ownership assignment for governance

Support audits and security reviews

• Identify dormant applications with active credentials

• Validate applications with SCIM or long-lived credentials

• Support least-privilege and lifecycle management initiatives