Maester Packs
MediumModule packFree

Least Privileged MSGraph

Checks that service principals hold only the Microsoft Graph permissions their real API activity needs, using Microsoft Graph activity logs in Log Analytics.

Version
1.0.0
Tests
5
Connectors
0
Published
25 Oct 2026

Mynster9361 · mynster9361.least-privileged-msgraph · 0 stars · Open source · MIT

PowerShell 
Install-MtPack Mynster9361/maester-pack-lpms

Install only packs from sources you trust. This pack is made by Mynster9361, not by Maester. The site only indexes and scans it: Install-MtPack downloads it straight from github.com/Mynster9361/maester-pack-lpms.

maester-packs.lock.json entry 
{  "Id": "mynster9361.least-privileged-msgraph",  "Source": "Mynster9361/maester-pack-lpms",  "Version": "1.0.0",  "Commit": "6868b8a6e047c88c80b24c3d1d3c40809a402d31",  "Digest": "sha256:aec769ec4373f32d3ab1bac69ba47d228a4f9192788af1d8c087b006af852a36"}

← All tests

MP.LPMS.1005 Least Privileged MSGraph permission analysis report

Severity: InfoAzure

Adds the LeastPrivilegedMSGraph permission analysis report to this Maester report.

The report is the interactive page that the LeastPrivilegedMSGraph module writes with Export-LPMSPermissionAnalysisReport, filled with the same analysis that MP.LPMS.1001 to MP.LPMS.1004 use. For every service principal it shows the current, optimal, excess and missing permissions, the API calls it made and its throttling, with search, filters and CSV export.

Open it with the Least Privileged MSGraph button below, or under Reports in the left menu of this report. The report holds the names and permissions of your applications, so share this Maester report as you would the analysis itself. It is left out of a report made with Invoke-Maester -RedactUserIdentity.

Remediation action

This test only adds the report; it never fails. Act on the findings of MP.LPMS.1001 to MP.LPMS.1004. To leave the report out, disable this test in maester-config.json:

{ "TestSettings": [ { "Id": "MP.LPMS.1005", "Enabled": false } ] }

Related links

%TestResult%