Application permissions are app-only privileges in Microsoft Entra ID that let software access resources without a signed-in user. They are commonly assigned to service principals, managed identities, and automation apps so background tasks can read mail, files, directory objects, or other tenant data.
They matter because they are powerful and persistent: if an app’s secret, certificate, or consent is compromised, an attacker can act directly through the application even when user accounts are locked down. In real defenses, security teams review granted app permissions, remove stale consent, rotate credentials, and enforce least privilege. In attacks, abuse often looks like quiet, non-interactive access that bypasses normal user sign-in controls.