rules/findings/entra/enterprise_applications/eid-enterprise-app-with-high-entra-privileged-permissions_dynamic_param.json
|
{
"provider": "EntraID", "serviceType": "Enterprise Applications", "serviceName": "Microsoft Entra ID", "displayName": "_ARG_0_", "description": "Over-privileged applications represent a critical security risk in modern identity environments. When an application is granted broad permissions such as \u0060Directory.ReadWrite.All\u0060, \u0060Application.ReadWrite.All\u0060, or \u0060RoleManagement.ReadWrite.Directory\u0060, it gains unrestricted capabilities to read and modify critical directory resources, manage other applications, manipulate administrative role assignments, and access sensitive organisational data. In many cases, these applications only require a narrow subset of these capabilities\u2014for example, an application might need to read user profiles but has been granted permissions to modify them, or an application might need to read group memberships but has been granted permissions to create and delete groups across the entire tenant.", "rationale": "The security implications of excessive permissions compound over time. Applications granted \u0060AppRoleAssignment.ReadWrite.All\u0060 can elevate their own privileges or grant permissions to other applications, effectively allowing them to bypass governance controls. Applications with \u0060User.ReadWrite.All\u0060 can modify user attributes, reset passwords, update authentication methods, and disable accounts\u2014capabilities often unnecessary for automation tasks that only need to read user information. Applications granted \u0060Mail.ReadWrite\u0060 across all mailboxes can access executive communications, regulatory correspondence, and confidential business information when they might only need to send automated notifications.", "impact": "", "remediation": { "text": "\n\t\t\t###### To remediate using the UI:\n\t\t\t1 Navigate to **Microsoft Entra Admin Centre** \u2192 **Enterprise Applications**\n\t\t\t2 Select the application and navigate to **Permissions**\n\t\t\t3 Select the **Admin consent** tab to review granted permissions\n\t\t\t4 Identify permissions that exceed application\u0027s functional requirements\n\t\t\t6 Apply principle of least privilege\n\t\t\t\t* \u0060Directory.ReadWrite.All\u0060 \u2192 Consider scoped alternatives like \u0060User.ReadWrite.All\u0060 or \u0060Group.ReadWrite.All\u0060\n\t\t\t\t* \u0060Application.ReadWrite.All\u0060 \u2192 Consider \u0060Application.Read.All\u0060 if write access unnecessary\n\t\t\t\t* \u0060Mail.ReadWrite\u0060 \u2192 Consider \u0060Mail.Read\u0060 or specific mailbox access through application access policies\n\t\t\t\t* \u0060AppRoleAssignment.ReadWrite.All\u0060 \u2192 Remove if application doesn\u0027t manage permissions\n\t\t\t7 Revoke unnecessary permissions by selecting the **...** control and choosing **Revoke permission**\n\t\t", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/graph/permissions-overview?tabs=http", "https://learn.microsoft.com/en-us/graph/permissions-reference", "https://learn.microsoft.com/en-us/security/zero-trust/develop/identity", "https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/manage-app-consent-policies?pivots=ms-powershell" ], "compliance": [ { "name": "", "version": "", "reference": "", "profile": [] } ], "level": "high", "tags": [], "rule": { "path": "aad_managed_app", "subPath": null, "selectCondition": {}, "data": { "properties": { "id": "id", "accountEnabled": "accountEnabled", "appDisplayName": "appDisplayName", "appDescription": "appDescription", "appId": "appId", "displayName": "displayName", "signInAudience": "signInAudience", "foreign": "foreign", "owners": "owners", "permissions.*": "permissions" }, "expandObject": "permissions" }, "query": [ { "filter": [ { "conditions": [ [ "permissionType", "eq", "_ARG_1_" ], [ "foreign", "eq", "_ARG_2_" ] ], "operator": "and" } ] }, { "connectOperator": "and", "filter": [ { "include": "enterprise-app-permissions.json" } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "id": "Application Id", "appDisplayName": "Display Name", "apiName": "Resource Display Name", "permissionType": "Permission Type", "claimValue": "Permision", "permissionDisplayName": "Permission Name", "foreign": "Foreign" } }, "table": null, "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [ "*" ], "expandObject": null, "limit": null }, "showGoToButton": false, "showModalButton": false, "directLink": null } }, "text": { "data": { "properties": { "id": "Application Id", "appDisplayName": "Display Name", "apiName": "Resource Display Name", "permissionType": "Permission Type", "claimValue": "Permision", "permissionDisplayName": "Permission Name", "foreign": "Foreign" } }, "status": { "keyName": [ "principalDisplayName" ], "message": "{principalDisplayName} with High Privilege _ARG_1_ API Permissions", "defaultMessage": "_ARG_0_" }, "properties": { "resourceName": "displayName", "resourceId": "id", "resourceType": "EntraEnterpriseApplication" }, "onlyStatus": false } }, "idSuffix": "eid_app_with_high_priv__ARG_1___ARG_3_", "notes": [], "categories": [], "immutableProperties": [ "id", "displayName" ], "id": "entraid__ARG_4_" } |