Free Tool · Shadow-IT OAuth Governance
OAuth Scope Risk Explainer
Paste Microsoft Graph or Google Workspace OAuth permission scopes below to calculate a 0–100 blast-radius score, plain-English impact, and least-privilege alternatives.
Blast-Radius Risk Score
82 / 100
Critical blast radius: this grant can read/write mailboxes, files, or directory roles. Require admin review and vendor assessment in Pistos.
Mail.ReadWriteCRITICAL (+35 pts)Read and write mail in user mailboxes
Allows the app to read every email, attachment, password reset link, and create hidden inbox rules in the consenting user’s mailbox.
Least-privilege alternative: Mail.Send (if sending notifications) or User.Read
Calendars.ReadWriteMEDIUM (+14 pts)Read and write user calendars
Allows reading meeting titles, attendee lists, and dial-in links, and inserting or modifying calendar invites.
Least-privilege alternative: Calendars.ReadBasic
Files.ReadWrite.AllHIGH (+30 pts)Read and write all files user can access in OneDrive & SharePoint
Allows the app to download, modify, or encrypt every OneDrive and SharePoint document the user has permission to open.
Least-privilege alternative: Files.Read.Selected (picker-scoped access to individual files)
User.ReadLOW (+3 pts)Sign in and read basic user profile
Standard OpenID sign-in scope allowing the app to read the signed-in user’s name, email, and basic profile.
Least-privilege alternative: openid profile email