Microsoft Graph has expanded to include hundreds of application permissions and delegated OAuth scopes, making manual tracking impractical.
Continuous automated monitoring is essential to detect privilege drift and maintain least-privilege access.
A PowerShell script extracts the service principal’s app roles and OAuth scopes directly from Microsoft Graph and exports them to CSV.
The CSV files are stored in a SharePoint Online library, serving as a baseline for future comparisons.
Each run generates a new CSV, compares it to the baseline, highlights differences, updates the baseline, and sends email notifications.
An August 29 execution revealed thirteen new authentication-related permissions, offering finer-grained control over password reset and MFA settings.
These granular scopes enable organizations to replace broad permissions like User.ReadWrite.All with more specific alternatives.
Over-privileged apps increase the blast radius of compromised credentials and conflict with regulatory least-privilege requirements.
Azure Automation seemed ideal for hosting the script using a system-assigned managed identity for secure, credential-free execution.
However, the Microsoft.Graph.Files module returned zero cmdlets inside the Automation sandbox, causing file-operation failures.
To bypass the module issue, the script was rewritten to interact with SharePoint files via raw Microsoft Graph HTTP requests using the managed identity’s bearer token.
By establishing a reliable baseline, scheduling weekly diffs, testing narrower scopes in staging, and integrating results into governance metrics, organizations can continuously enforce least-privilege access.