🔐 LeastPrivilegedMSGraph

PowerShell module for analyzing Microsoft Graph permissions

🚀 Quick Start

Install-Module -Name LeastPrivilegedMSGraph -Repository PSGallery
Import-Module LeastPrivilegedMSGraph

# Initialize and connect
Initialize-LogAnalyticsApi
Connect-EntraService -ClientID $clientId -TenantID $tenantId -ClientSecret $secret -Service "LogAnalytics", "GraphBeta"

# Analyze permissions
$apps = Get-AppRoleAssignment |
    Get-AppActivityData -WorkspaceId $workspaceId -Days 30 |
    Get-AppThrottlingData -WorkspaceId $workspaceId -Days 30 |
    Get-PermissionAnalysis

# Generate report
Export-PermissionAnalysisReport -AppData $apps -OutputPath ".\report.html"

✨ Key Features

🔍 Permission Analysis

Analyzes Microsoft Graph permissions against actual API usage from Log Analytics to determine the minimal permission set required based on real activity patterns.

📊 Activity Monitoring

Tracks application API usage patterns over configurable time periods, identifying which endpoints are accessed and with what HTTP methods.

🚦 Throttling Detection

Monitors API throttling statistics including 429 errors, success rates, and automatic severity classification to identify performance issues.

📈 Interactive Reports

Generates beautiful, self-contained HTML reports with filtering, sorting, and detailed visualizations of permission usage and recommendations.

🔐 Security First

Identifies over-privileged applications with unused permissions and provides actionable recommendations for implementing least privilege access.

⚡ Pipeline-Friendly

Designed for PowerShell pipeline operations with efficient batch processing for analyzing hundreds of applications at once.

📖 Documentation

🚀 Getting Started Guide 📚 Command Reference 💻 GitHub Repository 📦 PowerShell Gallery

🎯 Why LeastPrivilegedMSGraph?

🛠️ What It Does

LeastPrivilegedMSGraph helps you implement the principle of least privilege for Microsoft Graph API permissions by:

  1. Retrieving Current Permissions: Gets all app role assignments for Microsoft Graph across your tenant
  2. Analyzing Activity: Queries Log Analytics for actual API calls made by each application
  3. Monitoring Health: Collects throttling statistics to identify performance issues
  4. Calculating Optimal Permissions: Uses permission mapping and set cover algorithm to determine minimal required permissions
  5. Identifying Gaps: Highlights excess permissions that can be removed and missing permissions that should be added
  6. Generating Reports: Creates interactive HTML reports for review, compliance, and change requests

📋 Use Cases

🔒 Security Hardening

Identify and remove unnecessary permissions to reduce attack surface and improve security posture across all Graph API applications.

✅ Compliance Audits

Generate evidence-based reports demonstrating least privilege implementation for SOC 2, ISO 27001, and other compliance frameworks.

🔄 Permission Right-Sizing

Optimize permission grants based on actual usage patterns, removing over-privileging while ensuring applications have what they need.

📊 Governance Monitoring

Regularly review permission usage to detect drift, unused apps, and potential security issues before they become problems.

🎫 Change Requests

Generate detailed reports with specific permission recommendations to attach to change requests and approval workflows.

🚨 Incident Response

Quickly identify which applications have access to sensitive data during security incidents or breach investigations.

🏗️ Module Architecture

The module follows a pipeline-based architecture with six main cmdlets:

🎓 Learn More

⚙️ Prerequisites

🤝 Contributing

Contributions are welcome! This is an open-source project under the MIT License.

Contributing Guidelines