Untitled attachment

Notices where this attachment appears

1. Embed this notice
   Merill #microsoft #azuread :verified: :donor: (merill@infosec.exchange)'s status on Wednesday, 11-Sep-2024 17:23:57 JST Merill #microsoft #azuread :verified: :donor:

   🃏 Here's a graph permission, least privilege quiz.

   Try to figure out the least privilege permission before swiping for the answer.

   Compare the permissions for https://graph.pm/Group.Read.All vs https://graph.pm/GroupMember.Read.All

   When you grant Group.Read.All application permissions to an app you give it access to read all of this information, for all groups in the tenant...

   Including Group/Teams
   📆 Calendars
   💬 Conversations
   👥 Contacts
   📓 Planner
   📁 Files
   🗄️ SharePoint sites