Token Watch
Permissions and Microsoft Graph access
Updated September 7, 2026
Every permission Token Watch requests, the endpoint it uses them against, and the operations the resulting grant cannot perform.
Permissions requested
| Permission | Type | Purpose |
|---|---|---|
Application.Read.All |
Application | Reads the App Registrations in the tenant and the expiry metadata on their client secrets and certificates. |
openid, profile, email |
Delegated | OpenID Connect sign-in. Identifies the signed-in user (name, email, object id and tenant id) so access can be scoped to their tenant. Authentication happens entirely on Microsoft’s side; no password reaches Token Watch. |
Why the Graph read is an application permission
A delegated permission acts as the signed-in user and works only while a user session is valid; an application permission acts as the service itself, granted once, tenant-wide, by an administrator.
Token Watch uses an application permission because the expiry check runs unattended, on a schedule, on days when nobody signs in.
The trade-off is that the grant is tenant-wide and does not inherit a user’s restrictions. That is why it is the read-only permission, and why it covers one object type.
Graph endpoints called
Token Watch issues one kind of Microsoft Graph request:
GET https://graph.microsoft.com/v1.0/applications?$expand=owners($select=id)
Graph pages that collection. Token Watch follows the returned @odata.nextLink until
the list is complete; those follow-up URLs are the only other addresses requested, and each is
validated before use: scheme must be https and host must be exactly
graph.microsoft.com, otherwise the sync fails rather than sending the tenant’s
access token to an arbitrary host.
Access tokens are acquired per tenant via the OAuth 2.0 client credentials flow against
login.microsoftonline.com/{your-tenant-id} and cached in memory keyed by tenant id for
the life of the process. Each request carries the token for the tenant whose data is being read.
What the grant cannot do
| Capability | Reason | |
|---|---|---|
| Create, edit or delete an App Registration | No | Requires Application.ReadWrite.All, which is not requested or granted. |
| Add, rotate or remove a client secret or certificate | No | Same write permission. Rotation remains entirely in your hands. |
| Read the value of a client secret | No | Graph returns the field as null to every caller after creation, including Microsoft’s own portal. No permission changes this. |
| Read a certificate private key | No | Private keys are not held in the App Registration; only the public certificate is. That field is not deserialised, so it is discarded during response parsing. |
| Read users, groups, mailboxes, files or sign-in logs | No | Requires directory, mail or file permissions that are not requested or granted. |
| Sign in as one of your users, or act on their behalf | No | No impersonation permission is held, and no user password reaches Token Watch. |
| Reach into your network | No | All connections are outbound to Microsoft Graph. Nothing is installed in your environment and nothing connects inbound. |
| List App Registrations and their credential expiry dates | Yes | The sole use of the grant. |
Never received
Some data never reaches Token Watch at all, either because no permission is held to read it or because Microsoft Graph does not return it to any caller.
| Client secret values | Never | Graph does not return them after creation, to any caller. |
| Certificate private keys | Never | Not held in the App Registration. |
| Public certificate blobs | Never | Present in the Graph response; not deserialised. |
| User passwords and MFA secrets | Never | Authentication is handled entirely by Entra ID. |
| Directory contents: users, groups, roles, devices | Never | No permission is held to read them. |
| Mail, files, Teams messages, calendar data | Never | No permission is held to read them. |
| Tenant sign-in and audit logs | Never | No permission is held to read them. |
| Payment card numbers | Never | Handled by Paddle or Microsoft as merchant of record. |
Related
- What data Token Watch holds — the fields the read above produces.
- Revoking access — withdrawing the grant described here.
- Architecture, hosting and encryption — where that data goes next.
- Connect your Microsoft Entra tenant — the setup walkthrough.