Maester Packs
MediumModule packFree

Least Privileged MSGraph

Checks that service principals hold only the Microsoft Graph permissions their real API activity needs, using Microsoft Graph activity logs in Log Analytics.

Version
1.0.0
Tests
5
Connectors
0
Published
25 Oct 2026

Mynster9361 · mynster9361.least-privileged-msgraph · 0 stars · Open source · MIT

PowerShell 
Install-MtPack Mynster9361/maester-pack-lpms

Install only packs from sources you trust. This pack is made by Mynster9361, not by Maester. The site only indexes and scans it: Install-MtPack downloads it straight from github.com/Mynster9361/maester-pack-lpms.

maester-packs.lock.json entry 
{  "Id": "mynster9361.least-privileged-msgraph",  "Source": "Mynster9361/maester-pack-lpms",  "Version": "1.0.0",  "Commit": "6868b8a6e047c88c80b24c3d1d3c40809a402d31",  "Digest": "sha256:aec769ec4373f32d3ab1bac69ba47d228a4f9192788af1d8c087b006af852a36"}
IDTitleSeverityProduct
MP.LPMS.1001 Service principals hold only the Microsoft Graph permissions their activity requires Medium Entra ID
MP.LPMS.1002 All Microsoft Graph activity of service principals matches a known endpoint Low Entra ID
MP.LPMS.1003 Service principals are not throttled at Warning or Critical level by Microsoft Graph Low Entra ID
MP.LPMS.1004 Service principals with Microsoft Graph permissions show activity in the analysis window Medium Entra ID
MP.LPMS.1005 Least Privileged MSGraph permission analysis report Info Entra ID