Rules/APP-005.granted-high-privilege.psd1
|
@{ Id = 'APP-005' Title = 'No granted high-privilege Graph application roles (including third-party apps)' Area = 'ConsentGrants' Severity = 'High' References = @( 'https://learn.microsoft.com/graph/permissions-reference' 'https://learn.microsoft.com/entra/identity/enterprise-apps/manage-application-permissions' ) Rationale = 'APP-002 sees what your own app registrations request; this rule sees what is actually granted tenant-wide - including third-party vendor apps. A granted Directory.ReadWrite.All acts without any user, whoever holds the credential.' Remediation = 'Review each flagged grant: is the vendor/app still needed, is there a least-privilege alternative, can it be scoped? Revoke what is not clearly justified.' Test = { param($Snapshot) $grants = @($Snapshot.ConsentGrants.appRoleGrants) $highPrivilege = @($grants | Where-Object { $_._tlIsHighPrivilege }) if ($highPrivilege.Count -gt 0) { New-TLRuleResult -Status Fail -Evidence @($highPrivilege | Select-Object -First 15 | ForEach-Object { "{0}: {1}" -f $_.principalDisplayName, $_._tlPermission }) } else { New-TLRuleResult -Status Pass -Evidence ("No high-privilege Graph application roles granted ({0} grants total)." -f $grants.Count) } } } |