[FR] - Feedback for the MSEntraID Responder

[stacsirt]

Hi There:

I noticed in step 7 of the setup instructions that you recommend adding the Directory.ReadWrite.All and User.ReadWrite.All API permissions. However, I tested the analyzer in my tenant and found that Directory.Read.All (Microsoft Graph API, application permission) works perfectly fine. There’s no need for the write permissions in this case.

I hope this helps clarify the requirements and potentially simplify the setup for others.

Regards,
Lyle

[nusantara-self]

Hello Lyle,

Thanks for notifying this to us! I think there might have been a confusion with the responder documentation. I have just checked and the documentation of the analyzer mentions the use of Directory.Read.All, AuditLog.Read.All, and Policy.Read.ConditionalAccess permissions for the analyzer.

However, the responder, recommends Directory.ReadWrite.All and User.ReadWrite.All, as it signs out a user / revoke all tokens.

If you find that any of the recommended permissions are more permissive than necessary for certain use cases, please let us know and we would be happy to update the documentation accordingly.

Have a great day ahead,
Fabien