Admin consent gives an app every mailbox in the tenant. Scoping it back down means knowing which mailboxes it actually uses, and the tools you’d reach for first can’t tell you. I wrote a script that reads the audit log and builds the scope from what it finds.
Federation metadata is public on purpose. This script reads the certificates out of it and tells you how long each one has left, without signing in to anything.
Moving corporate FortiTokens from Okta to Entra ID meant activating every token, and activation wants a code read off the device. With the seed file in hand, the script types the code itself.
A public-sector Okta org with several Entra tenants needed MFA at every access. Two failed attempts and one skipped documentation line later, the amr claim made it work.
Apps requesting only baseline scopes used to slip past All-resources CA policies that had an exclusion. As of the June 2026 rollout they don’t. Here’s a read-only report that finds the affected apps without pulling sign-in logs for the whole tenant.