OAuth Grants

Every time an employee clicks “Sign in with Google” or authorizes a third-party app to access their account, they create an OAuth grant. These accumulate silently, often persist long after the app is abandoned, and can carry significant permission scopes. Porcia inventories the OAuth grants available from your connected identity providers and scores each one by risk.

​

Where to find it

Assets → Integrations → OAuth Grants This section also contains two related pages:

• Risk Score — workspace-level overview of grant risk distribution across your org
• MCP Connections — AI agent connections using the Model Context Protocol, discovered by the Porcia desktop agent

​

How grants are discovered

OAuth grants come from your connected identity providers:

• Google Workspace — third-party apps users have authorized to access their Google accounts
• Microsoft Entra — delegated permissions users and admins have granted to apps
• Okta — apps assigned to users, and user consents for apps that use Okta to authorize access. Apps that only use Okta for sign-in manage their own OAuth access and may not appear.

The grant inventory refreshes automatically on a regular schedule.

​

Risk scoring

Each grant is scored using factors such as how broad and sensitive its permissions are, how recently it was used, how long it has existed, publisher context, and how many people granted it. The Risk Score sub-page shows a distribution chart of grants by risk level so you can see your overall posture at a glance.

​

The grants view

The OAuth Grants page shows the available inventory with:

• App name and icon
• Authorized users (count of employees who granted access)
• Permission scopes with human-readable descriptions
• Risk score and level
• Last activity date
• Grant age

​

Filtering

Filter by risk level, app, user, or grant status. Sort by risk level, user count, or grant age.

​

Revoking a grant

What revoking does depends on the provider:

• Google Workspace and Microsoft Entra — removes the app’s delegated access for the affected users.
• Okta — removes the user’s assignment to the app in Okta.

If you have set up automatic revocation for denied apps, Porcia can revoke matching grants without a per-grant confirmation.

​

MCP Connections

The Assets → Integrations → MCP Connections sub-page inventories AI agent connections discovered by the Porcia desktop agent on employee machines, giving you visibility into your AI supply chain.

​

Grant findings

High-risk and stale grants automatically surface as Findings. This means they appear in the Findings page with severity, context, and remediation steps — the same workflow as other security issues.

​

Connecting your IdP to populate grants

Grants are only discoverable if you’ve connected an identity provider. The more IdPs connected, the more complete your grant inventory. → Connect Google Workspace · Connect Microsoft Entra · Connect Okta

​

Next steps