Add graph tier0 permission validation #645
Conversation
There was a problem hiding this comment.
This PR should only contain changes related to the test description:
Added test where app registrations are checked for having tier-0 graph permissions with a risk of having a direct or indirect path to Global Admin and full tenant takeover.
This will make review, approval, and merging easier to safely manage.
…h permissions assigned
HenrikPiecha
force-pushed
the
add-graph-tier0-permission-validation
branch
from
2a5d7cd to
465e55e
Compare
|
Removed commits that are handeled in separate PR. |
| @@ -0,0 +1,53 @@ | |||
| Ensure no graph application has permissions with a risk of having a direct or indirect path to Global Admin and full tenant takeover. | |||
|
|
|||
| This test if any application has tier-0 graph permissions with a risk of having a direct or indirect path to Global Admin and full tenant takeover. | |||
There was a problem hiding this comment.
Grammar? "This test checks if any application..."
Corrected grammar issue. -> "This test 'checks' if any application..."
|
Well... there are a lot of scenarios where at least permissions with an indirect path to a global administrator are required. Maester itself requires “RoleEligibilitySchedule.ReadWrite.Directory”, which also has a known indirect path to a global administrator. Should I extend the test-description with this information? |
I do like the idea of putting that concept into the description, so admins don't get the impression that it is an all or nothing decision for 100% of real-world scenarios. 👍 |
Added conceptional description for valid use-cases into test description: "There are several use cases where Tier-0 permissions with an indirect attack path are required. For example, Maester itself requires the permission “RoleEligibilitySchedule.ReadWrite.Directory” to properly validate the PIM assignments. Nevertheless, an administrator should question the use of these permissions and check whether less critical permissions are also sufficient. Applications that are provided by third-party vendors that do have Tier-0 permissions with direct or indirect attack paths should strictly be questioned and monitored. "
|
Updated test description as discussed. |
Added test where app registrations are checked for having tier-0 graph permissions with a risk of having a direct or indirect path to Global Admin and full tenant takeover.
This test was inspired by the Community Post in "Entra 🆔 News #80 → This week in Microsoft Entra" from "Emilien Socchi".
Further information: https://github.com/emiliensocchi/azure-tiering/tree/main/Microsoft%20Graph%20application%20permissions#tier-0