Test-MtHighPrivilegeServicePrincipalsForAllUsers

SYNOPSIS

Checks if any high-privilege first-party Microsoft service principals (e.g. Azure PowerShell, Azure CLI and Azure Developer CLI, Microsoft Graph Command Line Tools, Graph Explorer, Azure AD PowerShell, Exchange Online PowerShell, SharePoint Online Management Shell, Teams PowerShell, Power Platform CLI) are open to all users instead of requiring explicit assignment.

SYNTAX

Test-MtHighPrivilegeServicePrincipalsForAllUsers [-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION

A small set of Microsoft first-party applications carry broad, pre-consented delegated permissions to Azure Resource Manager and Microsoft Graph and are commonly used to enumerate or exfiltrate tenant data once an attacker has a foothold on any single user account. Unlike third-party apps, these Microsoft-owned apps can remain available without a visible service principal in the tenant and are easy to overlook when locking down 'Assignment required?'.

EXAMPLES

EXAMPLE 1

Test-MtHighPrivilegeServicePrincipalsForAllUsers

Returns true if none of the monitored high-privilege service principals can be used by any user.

PARAMETERS

-ProgressAction

Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

OUTPUTS

System.Boolean

NOTES

RELATED LINKS

https://maester.dev/docs/commands/Test-MtHighPrivilegeServicePrincipalsForAllUsers