Maester Packs
MediumModule packFree

Least Privileged MSGraph

Checks that service principals hold only the Microsoft Graph permissions their real API activity needs, using Microsoft Graph activity logs in Log Analytics.

Version
1.0.0
Tests
5
Connectors
0
Published
25 Oct 2026

Mynster9361 · mynster9361.least-privileged-msgraph · 0 stars · Open source · MIT

PowerShell 
Install-MtPack Mynster9361/maester-pack-lpms

Install only packs from sources you trust. This pack is made by Mynster9361, not by Maester. The site only indexes and scans it: Install-MtPack downloads it straight from github.com/Mynster9361/maester-pack-lpms.

maester-packs.lock.json entry 
{  "Id": "mynster9361.least-privileged-msgraph",  "Source": "Mynster9361/maester-pack-lpms",  "Version": "1.0.0",  "Commit": "6868b8a6e047c88c80b24c3d1d3c40809a402d31",  "Digest": "sha256:aec769ec4373f32d3ab1bac69ba47d228a4f9192788af1d8c087b006af852a36"}

← All tests

MP.LPMS.1004 Service principals with Microsoft Graph permissions show activity in the analysis window

Severity: MediumAzure

Checks that every service principal with assigned Microsoft Graph API permissions recorded at least one API call during the analysis window.

A service principal that holds permissions but has not exercised them in the analysis period may be stale, abandoned, or incorrectly configured. Stale app registrations with active permissions represent an unnecessary attack surface: if the credentials are compromised or the registration is taken over, an attacker gains access to all assigned permissions with no legitimate business justification.

This check is reported as Investigate rather than an automatic failure because zero activity has several legitimate explanations:

  • The application is seasonal and only runs at certain times of year (consider widening LPMSDaysToQuery).
  • The application relies solely on delegated user flows and no users signed in during the period.
  • The application was recently registered and is not yet in production.
  • The application uses a non-Graph service and the Graph permissions are reserved for a future feature.

Remediation action

For each application listed below:

  1. Contact the application owner and confirm whether the application is still in use.
  2. If the application is no longer needed:
    • Sign in to the Microsoft Entra admin center as at least an Application Administrator.
    • Browse to Identity > Applications > App registrations > select the application.
    • Select Delete to remove the registration entirely, or navigate to API permissions and remove all permissions.
  3. If the application is seasonal or infrequent, widen the analysis window by increasing LPMSDaysToQuery (e.g., 90) and re-run the check. Note: more days increases memory use during the run.
  4. If the application only makes delegated calls driven by end-user sign-ins, consider whether it still needs its current permission scope.

Related links

%TestResult%