pH7x SystemspH7x Systems®
ExpertiseKnowledgeToolsField GuideBlogAbout
← pH7x KnowledgeMicrosoft 365

Delegated vs application identity in Microsoft 365 evidence

Whose view of the tenant am I actually reading?

By João Livio·pH7x Knowledge

30-second answer

A delegated identity reads what one signed-in person can read. An application identity with Sites.Read.All and admin consent reads the tenant. Every number produced under delegation carries an unspoken clause: as far as this identity could see.

powershell
# Delegated: the user's view
Connect-PnPOnline -Url $site -Interactive -ClientId $appId

What this proves

Which scope of visibility produced your data. The same script, the same tenant and two different identities produce two different inventories, and both are correct about what they saw.

What it does not prove

  • A delegated inventory is not the tenant. On a real tenant, a delegated identity enumerated 53 sites and could read evidence from 47; six refused outright with Attempted to perform an unauthorized operation. Those six were not empty, not missing and not compliant; they were unread.
  • An application identity is not automatically safer. It sees everything, unattended, which is exactly why it needs admin consent and certificate credentials rather than a password in a script.

PowerShell

powershell
# What identity produced this session's reads?
(Get-PnPConnection).ClientId
# Delegated sessions act as the signed-in user; record who that was,
# because the evidence is only reproducible under the same visibility.
(Get-PnPProperty -ClientObject (Get-PnPContext).Web -Property CurrentUser).LoginName

Example output

text
53 sites enumerated
47 produced evidence
 6 refused: Attempted to perform an unauthorized operation

Explanation

The honest report states its identity kind next to its numbers. "47 sites" means one thing from an application identity and another from a delegated one, and a reader cannot tell which without being told. Recording identity_kind in the evidence itself, alongside collection timestamps and scopes, is what lets the same question be re-asked later under the same conditions, which is most of what reproducibility means.

Production considerations

  • Delegated evidence is bounded by one person's rights, which change when their roles change. Two runs a month apart can differ because the person changed, not the tenant.
  • Application identities need certificate credentials and admin consent; plan the registration as infrastructure, not as a script detail.
  • Whichever identity collects, a refusal is a fact worth keeping. A site that would not be read belongs in the report as unread, never as absent.

References