Public
- Public
- Network
- Groups
- Featured
- Popular
- People

Conversation

Notices

Embed this notice
Merill #microsoft #azuread :verified: :donor: (merill@infosec.exchange)'s status on Wednesday, 11-Sep-2024 17:23:57 JST Merill #microsoft #azuread :verified: :donor:

🃏 Here's a graph permission, least privilege quiz.
Try to figure out the least privilege permission before swiping for the answer.
Compare the permissions for https://graph.pm/Group.Read.All vs https://graph.pm/GroupMember.Read.All
When you grant Group.Read.All application permissions to an app you give it access to read all of this information, for all groups in the tenant...
Including Group/Teams
📆 Calendars
💬 Conversations
👥 Contacts
📓 Planner
📁 Files
🗄️ SharePoint sites
In conversation about 5 months ago from infosec.exchange permalink
Attachments
1. Untitled attachment
  https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/117/926/558/243/108/original/c16f55b9f5980048.png
2. Untitled attachment
  https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/117/926/721/373/607/original/de782094fa89d5fc.png
3. No result found on File_thumbnail lookup.
  
  Group.Read.All | Graph Permissions
  
  View all the Graph APIs and data exposed when granting Group.Read.All to an application.
4. No result found on File_thumbnail lookup.
  
  https://graphpermissions.merill.net/permission/GroupMember.Read.AllWhen

Feeds