MediumModule packFree

Least Privileged MSGraph

Checks that service principals hold only the Microsoft Graph permissions their real API activity needs, using Microsoft Graph activity logs in Log Analytics.

Version: 1.0.0
Tests: 5
Connectors: 0
Published: 25 Oct 2026

Mynster9361 · mynster9361.least-privileged-msgraph · 0 stars · Open source · MIT

PowerShell

Install-MtPack Mynster9361/maester-pack-lpms

Install only packs from sources you trust. This pack is made by Mynster9361, not by Maester. The site only indexes and scans it: Install-MtPack downloads it straight from github.com/Mynster9361/maester-pack-lpms.

maester-packs.lock.json entry

{  "Id": "mynster9361.least-privileged-msgraph",  "Source": "Mynster9361/maester-pack-lpms",  "Version": "1.0.0",  "Commit": "6868b8a6e047c88c80b24c3d1d3c40809a402d31",  "Digest": "sha256:aec769ec4373f32d3ab1bac69ba47d228a4f9192788af1d8c087b006af852a36"}

Risk: Medium

The scan found things a reviewer should read before installing.

Scanned 25 Oct 2026 at commit 6868b8a. Digest sha256:aec769ec4373f32d3ab1bac69ba47d228a4f9192788af1d8c087b006af852a36.

What it reaches

Services: Azure
Microsoft Graph scopes: Application.Read.All
Tenant writes: None
Network hosts: api.loganalytics.io, graph.microsoft.com
PowerShell modules: EntraAuth 1.8.56, LeastPrivilegedMSGraph 3.3.0

Scan findings

Severity	Finding	Where
Medium	Dependencies The pack uses 2 PowerShell Gallery module(s): EntraAuth 1.8.56, LeastPrivilegedMSGraph 3.3.0.