Risk Automations: Configure the ‘Revoke Microsoft Entra OAuth Tokens for Users’ Template

• Overview
• Step 1: Create an Entra app registration
• Step 2: Assign permissions
• Step 3: Generate a client secret
• Step 4: Add the credential to Risk Automations
• Replace the client secret before it expires

Overview

The Revoke Microsoft Entra OAuth Tokens for Users template removes OAuth tokens for a group of users on a specific app. Use it to reduce risk from OAuth tokens granted to unapproved apps or apps that are no longer in use.

Before it can run, Risk Automations needs a Microsoft Entra ID credential that connects to its own Entra app registration.

Setup workflow:

• Create an Entra app registration with permissions to revoke users’ OAuth tokens, and generate a client secret.
• Enter the app registration’s values into the Microsoft Entra ID credential.

You’ll gather three values from Entra:

• Application (client) ID
• Directory (tenant) ID
• Client secret value

Step 1: Create an Entra app registration

This template needs its own Entra app registration. Don’t reuse the registration you created for your User Risk directory integration.

1. Open the Microsoft Entra admin center.
2. Go to Identity > Applications > App registrations.
3. Click New registration.
4. Enter a name (for example, UpGuard-Revoke-OAuth-Tokens).
5. For Supported account types, select Single tenant.
6. Click Register.

To learn more, see Microsoft’s guide: Register an application in Microsoft Entra ID.

Step 2: Assign permissions

The workflow runs without a signed-in user, so it needs application permissions, not delegated permissions.

1. In your app registration, click API permissions.
2. Click Add a permission, then select Microsoft Graph.
3. Select Application permissions.
4. Select each permission in the table below.
5. Click Add permissions.
6. Click Grant admin consent for [your tenant name].
7. Check the Status column and confirm each permission shows Granted.

To learn more, see Microsoft’s guide: Configure app permissions for a web API.

Step 3: Generate a client secret

1. In your app registration, click Certificates & secrets, then Client secrets.
2. Click New client secret.
3. Enter a description that includes the expiry date (for example, UpGuard Risk Automations revoke tokens, expires [month year]).
4. Select an expiry date.
   • We recommend 12 months, but you can choose a shorter period if your security policy requires it. Entra caps a secret’s lifetime at 24 months.
   • You can’t extend a secret. When it expires, you create a new one.
   • Add the expiry date to your team’s calendar or ticketing system so you can replace the secret before it expires.
5. Click Add.
6. Copy the secret Value.

To learn more, see Microsoft’s guide: Add and manage application credentials in Microsoft Entra ID.

Step 4: Add the credential to Risk Automations

1. In the Entra admin center, go to your app registration’s Overview page.
2. Copy the Application (client) ID and the Directory (tenant) ID.
3. In UpGuard, navigate to Risk Automations > Credentials.
4. Select Microsoft Entra ID.
5. For Grant Type, select Client Credentials.
6. In Access Token URL, replace “common” with your Directory (tenant) ID.
7. In Client ID, enter your Application (client) ID.
8. In Client Secret, enter the client secret value you copied in Step 3.
9. Save the credential.

Your Microsoft Entra ID credential is now saved in Risk Automations. Next: configure, test, and activate your workflow.

Replace the client secret before it expires

Replace the secret before its expiry date so the workflow keeps running.

1. In the Entra admin center, go to your app registration, then Certificates & secrets > Client secrets.
2. Create a new secret and copy its Value.
3. In UpGuard, navigate to Risk Automations > Credentials and open the Microsoft Entra ID credential.
4. Replace the Client Secret with the new value and save.
5. Run the workflow to confirm it still works.
6. Return to Entra and delete the old secret.