Privileged API permissions on service principals should not remain unused
Part of Maester · Defender · Exposure Management · All checks
Invoke-Maester -TestId MT.1079Overview
Section titled “Overview”Unused privileged permissions should not remain assigned to a service principal because they increase the attack surface and risk of unauthorized access. If these permissions are not required for the application’s functionality, they can be exploited by attackers or misused, leading to potential privilege escalation or data exposure. Removing unnecessary privileged permissions helps maintain a stronger security posture and reduces the likelihood of security incidents.
How to fix
Section titled “How to fix”Review the findings in the Applications inventory in App Governance, and verify that there are no activities or use cases requiring the affected service principal to have assignments to these API permissions. Use hunting of app activities to review access and required permissions.
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | MT.1079 |
| Severity | Medium |
| Suite | Maester |
| Product | Defender |
| Related products | Entra ID |
| Feature | Exposure Management |
| Area | Applications and workload identities |
| Resource type | ServicePrincipal |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports controls | nist-800-53-r5:AC-6 |
| PowerShell test | Test-MtXspmAppRegWithPrivilegedUnusedPermissions |
| Services | Graph |
| Long running | Yes |
Source
Section titled “Source”- Test:
tests/maester/xspm/Test.MT.1079.ps1 - Documentation:
tests/maester/xspm/Test.MT.1079.md