Service Principal Security

[schrolla]

💡 Summary

Investigate the impact of service principals on M365 service security and determine potential threats that could be addressed through new SCuBA M365 baseline policies. Compare security posture in the face of identified threats for tenants implementing proposed service principal policies to those without those policies.

Motivation and context

Developing new policies around service principal security will lead to better security posture and outcomes for agencies implementing those policies.

Implementation notes

Implementing service principal policy enhancements will include:

• Identification of cyber threats that leverage service principal related vulnerabilities
• Developing M365 configurations that address identified threats and vulnerabilities
• Hands-on prototyping to determine the effects of service and policy changes on tenant security posture against those threats
• Determining baseline changes to align policy with service principal improvements
• Recommending baseline policy changes and updates based on investigation results

Acceptance criteria

• Set of cyber threats considered in scope of this investigation has been defined
• Tabletop or real-world attacks against tenant simulating these threats completed
• Risky applications and service principals added to the ScubaGear JSON and HTML reports
• Applications and service principals with privileged roles assigned add to JSON and HTML reports

Related Issues

• Add service principal assigned roles to the AAD report #934
• Prototype detection of service principals with risky permissions or credentials #1327
• Develop and execute adversary emulation tests on high-risk service principal permissions #1371
• Determine risky permissions assignable from both Microsoft Graph and other APIs #1397