Rules/APP-002.risky-permissions.psd1
|
@{ Id = 'APP-002' Title = 'No app registration requests high-privilege Graph application permissions' Area = 'Applications' Severity = 'High' References = @( 'https://learn.microsoft.com/graph/permissions-reference' 'https://learn.microsoft.com/entra/identity-platform/secure-least-privileged-access' ) Rationale = 'Application permissions like Directory.ReadWrite.All or RoleManagement.ReadWrite.Directory act without a signed-in user - a leaked credential of such an app is a tenant takeover.' Remediation = 'Review the flagged apps: replace broad application permissions with least-privilege alternatives or delegated permissions; remove what is unused.' Test = { param($Snapshot) $applications = @($Snapshot.Applications.applications) $affected = @($applications | Where-Object { $_.PSObject.Properties['_tlRiskyPermissions'] -and @($_._tlRiskyPermissions).Count -gt 0 }) if ($affected.Count -gt 0) { New-TLRuleResult -Status Fail -Evidence @($affected | ForEach-Object { "{0}: {1}" -f $_.displayName, (@($_._tlRiskyPermissions) -join ', ') }) } else { New-TLRuleResult -Status Pass -Evidence ("No high-privilege Graph application permissions requested across {0} app registrations." -f $applications.Count) } } } |