GraphPreConsentExplorer

During security assessments, I often rely on various pre-consented scopes for the Microsoft Graph API. To use these scopes, I need to know which Client IDs have specific pre-consented scopes on the Graph API. Additionally, as more organizations restrict the Device Code Flow, it is crucial to identify which clients allow authentication via the OAuth Code Flow. This requires knowing which clients support different authentication methods, including: - Device Code Flow - OAuth Code Flow - Special Refresh Flows (FOCI / BROCI) To address this, I used EntraTokenAid to perform thousands of authentication attempts using ~1600 first party clients. This process helped identify which clients work with specific authentication flows and their corresponding pre-consented scopes on the Microsoft Graph API. The result is a fairly large list of 368 Client IDs that have pre-consented scopes on the Graph API and can be used to authenticate without a client secret. All the information is stored in a YAML file, and there is a simple HTML GUI for easy search and filter navigation. It also provides easy copy-and-paste authentication commands for use with EntraTokenAid. GraphPreConsentExplorer is the open-source project zh54321/GraphPreConsentExplorer (https://github.com/zh54321/GraphPreConsentExplorer) by zh54321, released under MIT. Ion packages it unmodified from commit d521002fa3c1, adding only a manifest, an icon and a storage compatibility script.

Written by zh54321, published to Oikou by Ben Grande.

• ★ 168 stars on GitHub
• Licence: MIT
• Built from commit d521002fa3c1

View the repository on GitHub

Not rated. Nobody has said who this app is suitable for, so Personal Clouds and the Oikou app treat it as 18+.

Internet

It asks to reach nothing on the internet.

Personal Cloud tools

None. It uses nothing from your Personal Cloud beyond its own storage.

Notifications

It does not send push notifications.

Storage

Up to 16 MB on your Personal Cloud.

Sign in to add this web app to a Personal Cloud of yours. It runs there, on your own computer, and you open it from there; nothing is installed on your phone.

Sign in to add