Rules/APP-002.risky-permissions.psd1

@{
    Id          = 'APP-002'
    Title       = 'No app registration requests high-privilege Graph application permissions'
    Area        = 'Applications'
    Severity    = 'High'
    References  = @(
        'https://learn.microsoft.com/graph/permissions-reference'
        'https://learn.microsoft.com/entra/identity-platform/secure-least-privileged-access'
    )
    Rationale   = 'Application permissions like Directory.ReadWrite.All or RoleManagement.ReadWrite.Directory act without a signed-in user - a leaked credential of such an app is a tenant takeover.'
    Remediation = 'Review the flagged apps: replace broad application permissions with least-privilege alternatives or delegated permissions; remove what is unused.'
    Test        = {
        param($Snapshot)
        $applications = @($Snapshot.Applications.applications)
        $affected = @($applications | Where-Object {
                $_.PSObject.Properties['_tlRiskyPermissions'] -and @($_._tlRiskyPermissions).Count -gt 0
            })
        if ($affected.Count -gt 0) {
            New-TLRuleResult -Status Fail -Evidence @($affected | ForEach-Object {
                    "{0}: {1}" -f $_.displayName, (@($_._tlRiskyPermissions) -join ', ')
                })
        }
        else {
            New-TLRuleResult -Status Pass -Evidence ("No high-privilege Graph application permissions requested across {0} app registrations." -f $applications.Count)
        }
    }
}