What is the difference between permission review and activity log review when investigating OAuth integrations?

Permission review tells you what an app could do in principle, while activity log review tells you what it actually did. Permissions show the maximum access granted, including sensitive scopes or tenant-wide rights. Logs reveal whether the integration used that access, how often it did so, and whether its behavior matched the expected business purpose. Together they separate theoretical exposure from operational risk.

Permission review shows blast radius, activity log review shows real-world use

permission review and activity log review answer different investigation questions. Permissions tell you the maximum scope an OAuth integration was granted, which is what it could have accessed if abused. Activity logs show whether that access was actually exercised, how the app behaved over time, and whether the pattern fits the stated business purpose.

That distinction matters because OAuth risk is often hidden in the gap between granted consent and observed use. An integration may have broad tenant-wide rights yet never touch sensitive data, or it may have a narrow permission set but use it in a suspiciously repetitive or unexpected way.

Permission review is best for exposure assessment, scope creep, and consent hygiene.
Activity log review is best for detecting misuse, unusual volume, and deviation from normal application behavior.
Used together, they separate theoretical access from operational evidence.

Why investigators need both views for OAuth integrations

A permission review is usually static and structural. It answers what the app can reach across Graph, mail, files, messaging, or other APIs, and whether the granted scopes are broader than the integration needs. That makes it useful for identifying over-permissioned apps, stale consents, and high-impact access paths that should be reduced or removed.

Activity log review is dynamic and contextual. It helps you confirm whether the integration called the APIs it was entitled to call, whether it did so from expected tenants or service paths, and whether the timing and frequency match the normal workflow. For investigations, this is often the faster way to decide whether a broad permission set is merely risky on paper or already being exercised in practice.

Where possible, compare both views against the same business process. A payroll connector, CRM sync, or ticketing integration may legitimately touch many records, but its logs should still show bounded, explainable patterns. If the logs are sparse, incomplete, or absent, treat that as an observability problem because you cannot prove whether privileged access stayed within expected use.

Risk and Threat Considerations

OAuth integrations can create hidden exposure when broad consent is granted and nobody verifies whether the app actually uses it. Attackers often prefer these paths because a legitimate integration can provide durable access, tenant reach, and a lower-friction way to blend into ordinary application traffic.

Failure mechanism: Excessive permissions expand the blast radius if an app is compromised, while weak or missing activity review can hide token abuse, unusual API calls, or persistence through a trusted third-party integration.

Impact: Organisations may overestimate risk if they only look at permissions, or underestimate it if they only look at logs. The result can be missed overreach, delayed containment, and failure to distinguish benign automation from malicious use.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
OWASP Non-Human Identity Top 10	NHI-03 — Excessive Permissions	OAuth scope review directly assesses over-granted access in integrations.
	NHI-06 — Secret Rotation and Revocation	Investigation outcomes often require revoking compromised tokens or app access.
	NHI-08 — Visibility and Discovery	Activity log review depends on observing how integrations actually use their access.
Recommendation — Review and reduce granted OAuth scopes to the minimum required for the integration. Revoke and rotate affected OAuth tokens when misuse or compromise is suspected. Instrument and monitor integration activity so actual access can be distinguished from granted access.
CIS Controls v8	6.3 — Review and Update Access Rights	Permission review is an access-rights recertification problem for app access.
	8.2 — Audit Log Management	Activity log review relies on preserved logs of application and API activity.
Recommendation — Periodically review and remove OAuth permissions that no longer match business need. Centralize and retain OAuth and API logs to support investigation and anomaly detection.
NIST CSF 2.0	PR.AA — Identity Management, Authentication, and Access Control	OAuth permissions and token use are access-control decisions that shape exposure.
	DE.CM — Continuous Monitoring	Activity log review is a monitoring control for integration behavior and misuse.
	RS.AN — Analysis	Investigations compare granted permissions with observed behavior to determine whether misuse occurred.
Recommendation — Align OAuth consents and token use with least-privilege access governance. Continuously monitor OAuth activity for anomalous volume, timing, and data access patterns. Analyze OAuth permissions and logs together before deciding whether the integration is malicious or merely over-scoped.

Practitioner Guidance

What to verify: Confirm that the permission set matches the documented business function, then test whether the activity pattern supports that claim. If the app has broad scope but low or no use, prioritise scope reduction. If usage is active, focus on whether the calls are expected, frequent, and confined to the intended data domains.

Decision rule: If permissions are excessive, treat the integration as high exposure even before you prove abuse. If logs show access that the business owner cannot explain, treat that as a stronger signal than the consent screen alone and move to containment, token rotation, or re-approval.

Practitioner takeaway: Permission review tells you where the trust boundary was drawn; activity log review tells you whether that trust was exercised responsibly. In OAuth investigations, the strongest conclusion comes from comparing both, not from either one in isolation.