> ## Documentation Index
> Fetch the complete documentation index at: https://docs.porcia.org/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth Grants

> Inventory every third-party OAuth connection across your org — scored by risk, revocable from Assets → Integrations.

Every time an employee clicks "Sign in with Google" or authorizes a third-party app to access their account, they create an OAuth grant. These accumulate silently, often persist long after the app is abandoned, and can carry significant permission scopes.

Porcia inventories all OAuth grants discovered through your connected SSO providers and scores each one by risk.

## Where to find it

**Assets → Integrations → OAuth Grants** (`/assets/integrations/grants`)

This section also contains two related pages:

* **Risk Score** (`/assets/integrations/risk-score`) — workspace-level overview of grant risk distribution across your org
* **MCP Connections** (`/assets/integrations/mcp-connections`) — AI agent connections using the Model Context Protocol, discovered by the browser extension and desktop agent

## How grants are discovered

OAuth grants are discovered through SSO sync:

* **Google Workspace** — Admin SDK surfaces all third-party apps with OAuth access to your Google accounts
* **Microsoft Entra** — Microsoft Graph reports all enterprise app registrations and delegated permissions
* **Okta** — System logs and app catalog surface apps with OAuth-based access

Discovery runs on the same schedule as your SSO sync and picks up new grants automatically.

## Risk scoring

Each grant is scored based on a combination of factors:

| Factor            | What's evaluated                                                              |
| ----------------- | ----------------------------------------------------------------------------- |
| Permission scopes | Breadth and sensitivity (e.g. `mail.read` + `calendar.readwrite` = high risk) |
| Grant age         | How long the grant has existed                                                |
| Last activity     | Whether there's been recent authenticated usage                               |
| Publisher trust   | Known breach history, no verified publisher, low trust score                  |
| User count        | More users = larger blast radius if the app is compromised                    |

Risk levels: **Critical**, **High**, **Medium**, **Low**

The **Risk Score** sub-page shows a distribution chart of grants by risk level so you can see your overall posture at a glance.

## The grants view

The OAuth Grants page shows the full inventory with:

* App name and icon
* Authorized users (count of employees who granted access)
* Permission scopes with human-readable descriptions
* Risk score and level
* Last activity date
* Grant age

### Filtering

Filter by risk level, app, user, or grant status. Sort by risk level, user count, or grant age.

## Revoking a grant

<Steps>
  <Step title="Open the grant">
    Click any grant in the list to open its detail view — full scopes, authorized users, and risk explanation.
  </Step>

  <Step title="Review the impact">
    See which employees have this grant and what scopes will be revoked. Check whether any active workflows depend on this connection.
  </Step>

  <Step title="Revoke">
    Click **Revoke Access**. Porcia revokes via the IdP API immediately and logs the action in the audit trail.
  </Step>
</Steps>

<Warning>
  Revoking a grant removes that app's access immediately. Employees using the app through this connection will lose access until they re-authorize. Check the user count and last activity before revoking.
</Warning>

## MCP Connections

The **Assets → Integrations → MCP Connections** sub-page inventories AI agent connections discovered by the Porcia desktop agent and browser extension. This covers MCP servers, agent skills, and agent harnesses running on employee machines — giving you visibility into your AI supply chain.

## Grant findings

High-risk and stale grants automatically surface as [Findings](/governance/findings). This means they appear in the Findings page with severity, context, and remediation steps — the same workflow as other security issues.

## Connecting your IdP to populate grants

Grants are only discoverable if you've connected an identity provider. The more IdPs connected, the more complete your grant inventory.

→ [Connect Google Workspace](/integrations/sso/google-workspace) · [Connect Microsoft Entra](/integrations/sso/microsoft-entra) · [Connect Okta](/integrations/sso/okta)

## Next steps

<CardGroup cols={2}>
  <Card title="Findings" icon="triangle-exclamation" href="/governance/findings">
    Review security issues including high-risk grants
  </Card>

  <Card title="Rules" icon="bolt" href="/governance/rules">
    Auto-alert on new risky grants
  </Card>

  <Card title="Playbooks" icon="list-check" href="/governance/playbooks">
    Include grant revocation in offboarding workflows
  </Card>

  <Card title="SSO setup" icon="key" href="/integrations/sso/overview">
    Connect your IdP to populate the grant inventory
  </Card>
</CardGroup>