Test-MtHighRiskAppPermissions

SYNOPSIS

Check if any applications or service principals have high risk Graph permissions that can lead to direct or indirect paths to Global Administrator and full tenant takeover. The permissions are based on the research published at https://github.com/emiliensocchi/azure-tiering/tree/main.

SYNTAX

Test-MtHighRiskAppPermissions [[-AttackPath] <String>] [-ProgressAction <ActionPreference>]
 [<CommonParameters>]

DESCRIPTION

Applications that use Graph API permissions with a risk of having a direct or indirect path to Global Administrator and full tenant takeover.

EXAMPLES

EXAMPLE 1

Test-MtHighRiskAppPermissions

Returns true if no application has Tier-0 graph permissions

PARAMETERS

-AttackPath

Check for direct path to Global Administrator or indirect path through a combination of permissions. Default is “All”.

Type: String
Parameter Sets: (All)
Aliases:

Required: False
Position: 1
Default value: All
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction

Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

OUTPUTS

System.Boolean

NOTES

RELATED LINKS

https://maester.dev/docs/commands/Test-MtHighRiskAppPermissions