domains / families / security / performing-oauth-scope-minimization-review

performing-oauth-scope-minimization-review

separate

'Performs OAuth 2.0 scope minimization review to identify over-permissioned

When to use

• Annual or quarterly review of third-party application OAuth permissions
• After a security incident involving compromised OAuth tokens or unauthorized data access
• Compliance audit requiring documentation of third-party data access (GDPR Article 28, SOC 2)
• Discovery of shadow IT applications accessing organizational data via OAuth grants
• Migration or consolidation of SaaS applications requiring permission cleanup
• Implementing least-privilege principle for API integrations

When not to use

• reviewing first-party application permissions within the same trust boundary

Skill page

Source