# Privileged API permissions on service principals should not remain unused

Unused privileged permissions should not remain assigned to a service principal because they increase the attack surface and risk of unauthorized access.

Source: https://maester.dev/docs/tests/MT.1079

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/cloud-architekt" title="Thomas Naunheim · Original author"><img src="https://github.com/Cloud-Architekt.png" alt="Thomas Naunheim" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/cloud-architekt">Thomas Naunheim</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Defender · Exposure Management · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1079
```

## Overview

Unused privileged permissions should not remain assigned to a service principal because they increase the attack surface and risk of unauthorized access. If these permissions are not required for the application's functionality, they can be exploited by attackers or misused, leading to potential privilege escalation or data exposure. Removing unnecessary privileged permissions helps maintain a stronger security posture and reduces the likelihood of security incidents.

### How to fix

Review the findings in the [Applications inventory](https://learn.microsoft.com/defender-cloud-apps/applications-inventory#oauth-apps) in App Governance, and verify that there are no activities or use cases requiring the affected service principal to have assignments to these API permissions. Use [hunting of app activities](https://learn.microsoft.com/defender-cloud-apps/app-activity-threat-hunting) to review access and required permissions.

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1079 |
| Severity | Medium |
| Suite | Maester |
| Product | Defender |
| Related products | Entra ID |
| Feature | Exposure Management |
| Area | Applications and workload identities |
| Resource type | ServicePrincipal |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports controls | nist-800-53-r5:AC-6 |
| PowerShell test | [Test-MtXspmAppRegWithPrivilegedUnusedPermissions](https://github.com/maester365/maester/blob/main/tests/maester/xspm/Test.MT.1079.ps1) |
| Services | Graph |
| Long running | Yes |

</details>

## Source

- Test: [`tests/maester/xspm/Test.MT.1079.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/xspm/Test.MT.1079.ps1)
- Documentation: [`tests/maester/xspm/Test.MT.1079.md`](https://github.com/maester365/maester/blob/main/tests/maester/xspm/Test.MT.1079.md)