Maester Packs
MediumModule packFree

Least Privileged MSGraph

Checks that service principals hold only the Microsoft Graph permissions their real API activity needs, using Microsoft Graph activity logs in Log Analytics.

Version
1.0.0
Tests
5
Connectors
0
Published
25 Oct 2026

Mynster9361 · mynster9361.least-privileged-msgraph · 0 stars · Open source · MIT

PowerShell 
Install-MtPack Mynster9361/maester-pack-lpms

Install only packs from sources you trust. This pack is made by Mynster9361, not by Maester. The site only indexes and scans it: Install-MtPack downloads it straight from github.com/Mynster9361/maester-pack-lpms.

maester-packs.lock.json entry 
{  "Id": "mynster9361.least-privileged-msgraph",  "Source": "Mynster9361/maester-pack-lpms",  "Version": "1.0.0",  "Commit": "6868b8a6e047c88c80b24c3d1d3c40809a402d31",  "Digest": "sha256:aec769ec4373f32d3ab1bac69ba47d228a4f9192788af1d8c087b006af852a36"}

← All tests

MP.LPMS.1001 Service principals hold only the Microsoft Graph permissions their activity requires

Severity: MediumAzure

Checks that no service principal holds Microsoft Graph API permissions beyond those actively used during the analysis window.

Excess permissions violate the principle of least privilege. If a service principal is compromised, an attacker can abuse every permission assigned to it — even permissions the application never actually uses. Removing unused permissions directly reduces the blast radius of a credential or token compromise.

Remediation action

For each application listed below:

  1. Sign in to the Microsoft Entra admin center as at least an Application Administrator or Cloud Application Administrator.
  2. Browse to Identity > Applications > Enterprise applications, then open the affected application.
  3. Select Permissions > Admin consent (or User consent as applicable).
  4. Review the permissions flagged as excess and remove any that are not required for the application's intended function. Refer to the application owner to confirm which permissions are genuinely needed.
  5. If the application has application-type permissions (app roles), revoke them via App registrations > select the app > API permissions > remove the excess entries > Save.

Related links

%TestResult%