Notes From the Field: Finding and Remediating EWS App Usage Before Retirement

thejimmartin​ I'm finding that the script is not including in it's output some applications that I know are definitely using EWS (Rubrik for example). Is this error (unable to get app role assignments) stopping the script from getting a full list of all Entra service principals? 

If I run the following Copilot produced script it does include those Rubrik apps but unfortunately it doesn't output lastsignin details.

Connect-MgGraph -Scopes "Directory.Read.All"

$ewsRoleId = "dc890d15-9560-4a4c-9b7f-a736ec74ec40"

# Get all service principals with EWS full_access_as_app, including SignInActivity

$spWithEws = Get-MgBetaServicePrincipal -All `

-Property "AppId,DisplayName,AppRoleAssignments,SignInActivity" `

-ExpandProperty AppRoleAssignments |

Where-Object {

$_.AppRoleAssignments.appRoleId -contains $ewsRoleId

}

# Build report with LastSignIn

$ewsReport = $spWithEws | Select-Object DisplayName, Id, AppId,

@{Name="LastSignIn";Expression={$_.SignInActivity.LastSignInDateTime}}

$timestamp = (Get-Date).ToString("yyyyMMdd-HHmmss")

$path = "EWS-Apps-$timestamp.csv"

$ewsReport | Export-Csv -Path $path -NoTypeInformation

Write-Host "Export complete: $path"