performing-oauth-scope-minimization-review

name	performing-oauth-scope-minimization-review
description	Performs OAuth 2.0 scope minimization review to identify over-permissioned third-party application integrations, excessive API scopes, unused token grants, and risky OAuth consent patterns across identity providers and SaaS platforms. Activates for requests involving OAuth scope audit, API permission review, third-party app risk assessment, or consent grant minimization. . Use when working with performing oauth scope minimization review.
domain	cybersecurity
tags	["OAuth","scope-minimization","API-security","consent-review","third-party-risk","token-audit"]
subdomain	identity-access-management
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"]

Performing Oauth Scope Minimization Review

Overview

Cybersecurity skill for performing oauth scope minimization review. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "performing oauth scope minimization review"

• "Performs OAuth 2"

• Annual or quarterly review of third-party application OAuth permissions

• After a security incident involving compromised OAuth tokens or unauthorized data access

• Compliance audit requiring documentation of third-party data access (GDPR Article 28, SOC 2)

• Discovery of shadow IT applications accessing organizational data via OAuth grants

• Migration or consolidation of SaaS applications requiring permission cleanup

• Implementing least-privilege principle for API integrations

Do not use for reviewing first-party application permissions within the same trust boundary; OAuth scope minimization focuses on third-party and cross-boundary consent grants.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Admin access to identity providers (Microsoft Entra ID, Okta, Google Workspace)
• Microsoft Graph API permissions: Application.Read.All, OAuth2PermissionGrant.ReadWrite.All
• Inventory of approved third-party integrations from procurement or IT governance
• OAuth scope risk classification framework
• Tools for token analysis (jwt.io for manual review, automated scripts for bulk analysis)

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: ) -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}