EIDAPP-006: Excessive Microsoft Graph Permissions
- Plataforma
- Entra ID / M365
- Categoría
- Consent
- Severidad
- High
- Pilar de Zero Trust
- Applications & Workloads (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Applications granted broad Microsoft Graph application permissions such as Directory.ReadWrite.All, Sites.ReadWrite.All, or Mail.ReadWrite gain tenant-wide access to data and configuration without user context. Excessive Graph permissions violate the principle of least privilege and provide attackers who compromise the application with sweeping access to mailboxes, files, directory objects, and tenant settings. Permissions should be scoped to the minimum required for application functionality.
Valor recomendado
All Microsoft Graph permissions scoped to the minimum required with application permissions replaced by delegated permissions where possible
Remediación
Review Microsoft Graph permissions for all application registrations and identify any using broad .All scopes or application-level permissions where delegated permissions would suffice. Replace broad permissions with granular alternatives such as Mail.Read instead of Mail.ReadWrite.All or User.Read.All instead of Directory.Read.All. Use the Microsoft Graph permissions reference to identify the least-privilege permission for each API call the application makes.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| no-data | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6(1)
- MITRE ATT&CK
- T1098.002