Rename BulkMultiPermExploitability script and update README

Updated the script name from BulkMultiPermExploitability2.ps1 to BulkMultiPermExploitability.ps1 and revised its description. Adjusted usage examples in the README to reflect the new script name.

Author: rolling-code

README.md

@@ -39,7 +39,7 @@ PowerShell-Scripts/
 │   └── Test-AzureBlobAnonymousEndpoints.ps1
 │   └── 👉** Azure AD application auditing tools **
         list_all_applications.ps1
-        BulkMultiPermExploitability2.ps1
+        BulkMultiPermExploitability.ps1
         Profile-App.ps1
         Audit-AppDelegationRisks.ps1
 │   └── 👉** automate creation of malicious-looking OAuth authorization flows (device‑code and consent URLs) used in consent‑phishing simulations **
@@ -289,10 +289,23 @@ Connect-MgGraph -Scopes "User.Read.All", "Organization.Read.All", "LicenseAssign
 ### `list_all_applications.ps1`
 Enumerates all Microsoft Entra application registrations and enterprise application service principals visible to the current Microsoft Graph session. Exports separate application and service-principal reports, plus a normalized combined CSV inventory. Reuses an existing Graph session by default and supports optional interactive connection using Application.Read.All.
 
-### `BulkMultiPermExploitability2.ps1`
-- **Purpose:** Bulk‑checks each app for exploitable Microsoft Graph permissions against a defined high‑risk list.  
-- **Use Case:** Ideal for **tenant‑wide risk sweeps** and permission audits.  
-- **Frequency:** Run **monthly or quarterly** alongside inventory scans.  
+### `BulkMultiPermExploitability.ps1`
+BulkMultiPermExploitability.ps1 reviews Microsoft Entra applications for granted Microsoft Graph permissions that match a configurable high-risk permission catalog.
+The script evaluates both:
+
+Application permissions, represented by app-role assignments
+Delegated permissions, represented by OAuth2 permission grants
+
+It accepts an application inventory CSV produced by list_all_applications.ps1, using the ApplicationClientId column to correlate application registrations with their tenant service principals.
+The script is read-only. It reuses the current Microsoft Graph PowerShell session, does not request consent, does not modify application permissions, and does not disconnect the existing session.
+
+The recommended input is generated by: list_all_applications.ps1
+The recommended input for this permission review is: entra-application-registrations-YYYYMMDD-HHMMSS.csv
+```powershell
+.\BulkMultiPermExploitability.ps1 
+    -InputCsvPath ".\entra-application-registrations-20260730-175924.csv"
+```
+
 
 ### `Profile-App.ps1`
 - **Purpose:** Profiles a single AppId in detail.  
@@ -308,9 +321,9 @@ Enumerates all Microsoft Entra application registrations and enterprise applicat
 All scripts rely on the **[Microsoft.Graph PowerShell SDK](https://learn.microsoft.com/powershell/microsoftgraph/overview)**  
 Before running the scripts, establish a Graph session with sufficient rights:
 ```powershell
-.\list_all_applications2.ps1 //Generates CSV files
+.\list_all_applications.ps1 //Generates CSV files
 
-.\BulkMultiPermExploitability2.ps1 -ScopeCsvPath ScopeBreakdown.csv //This parses previously generated CSV file
+.\BulkMultiPermExploitability.ps1 -ScopeCsvPath ScopeBreakdown.csv //This parses previously generated CSV file
 ```
 
 When you see "Problem!" this is how you dig deeper into the app details