How to audit for app permission threats with Microsoft Entra workbooks

Modern organizations heavily rely on cloud apps and services, often granting these apps specific permissions to access data or execute tasks within their environments. However, improper app permissions or unauthorized changes can pose significant security risks, potentially leading to data exposure or compromised accounts. Identifying and mitigating app permission threats involves monitoring several key activities, including changes to app authentication methods, new permissions granted, and updates to service principal roles. Audit logs alone are insufficient for these tasks, as they require significant time to parse and interpret.

Microsoft Entra ID workbooks simplify this process by aggregating data into visual dashboards and interactive reports. These tools summarize the data from audit logs and categorize them. This allows IT teams to detect anomalies such as unauthorized permission changes, monitor trends in sensitive operations over time, and pinpoint high-risk actors or apps.

In this blog, we’ll explore how you can use Microsoft Entra ID workbooks to track app permission threats, delve into the details of key reports, and discuss how these tools enhance the security of your Microsoft 365 environment.

How to access the Sensitive Operations Report workbooks

To access the Sensitive Operations Report workbook in Microsoft Entra ID, follow these steps.

1. Log in to Microsoft Entra ID using an account with permissions to view workbooks.
2. Navigate to Identity > Monitoring & Health > Workbooks.
3. Select the Sensitive Operations Report workbook template from the available list.

Once you open the workbook, you’ll see a variety of reports categorized under key operations displaying details on modified credentials, permissions, and membership changes.

Microsoft Entra ID Sensitive Operations Report workbook explained

The Sensitive Operations Report workbook provides detailed insights into app permission changes and other critical activities. Here are the primary sections of the workbook and the insights they offer:

• Modified application and service principal credentials/authentication methods
• New permissions granted to service principals
• Directory role and group membership updates to service principals
• Modified federation settings

Modified application and service principal credentials/authentication methods

The reports under this category show the metrics and details on the modification of credentials used to sign in to apps and service principals. The reports are:

• Number of applications and service principals updated by authentication method
• Top actors updating authentication methods
• Updates to service principal authentication methods over time
• Recent updates to application/service principal authentication methods

Number of applications and service principals updated by authentication method

This report displays the count of apps and service principals that have had their authentication methods modified. Administrators can use this data to identify whether a certain type of credential is modified more frequently than others.

Top actors updating authentication methods

In this report, identify the users or processes who frequently change their authentication methods, ranked by activity volume. This helps pinpoint actors who may require further scrutiny since these activities indicate their accounts might have been hijacked.

Updates to service principal authentication methods over time

In this report, view trends in authentication method changes across a specific period. This graph aids in identifying patterns or spikes in authentication changes that may indicate malicious intent.

Recent updates to application/service principal authentication methods

This report contains a detailed list of the latest changes to authentication methods, including timestamps, actors, and affected apps. This comes in handy when administrators wish to identify the exact events summarized by the reports mentioned above.

New permissions granted to service principals

This category of reports monitors for changes to OAuth 2.0 permissions granted to service principals. Administrators can use this to identify privilege escalations where apps are granted higher permissions that either grant access to sensitive data or represent opportunities for lateral movement by attackers. There are two reports under this category:

New Application (AppOnly) permissions added to service principals

This report provides a list of AppOnly permission assignments to apps. This can be used to monitor newly added app permissions, which can have significant implications for security if misconfigured.

Recent app permissions activity

This report provides a chronological overview of all recent app permission activities with the details of who carried out said changes, helping administrators audit them and ensure that there are no unauthorized changes.

Directory role and group membership updates to service principals

This report highlights changes to service principals associated with directory roles and group memberships. Such changes can escalate privileges for these apps, which necessitates monitoring them closely for unauthorized modifications.

Modified federation settings

Federation settings govern how external entities authenticate with the on-premises domains of your organization that you synced with Microsoft Entra ID. This report displays any recent changes by users or apps to federation settings, ensuring that unauthorized modifications are detected promptly.

Get a clear overview of your Microsoft 365 environment with M365 Manager Plus

ManageEngine M365 Manager Plus is a comprehensive administration and security solution for Microsoft 365 used for reporting, managing, monitoring, auditing, and creating alerts for critical activities in your Microsoft 365 environments. You can gain a thorough understanding of your environment not just in Microsoft Entra ID, but also Exchange Online, SharePoint Online, OneDrive for Business, and other Microsoft 365 services, with detailed reports and intuitive visualizations, all from a single console.

There are even more benefits to using M365 Manager Plus to manage and monitor your Microsoft 365 environment:

• Filter your reports just once and save them as custom reports that you can access in just a few clicks.
• Export reports generated in M365 Manager Plus in not just CSV, but also in other presentable formats such as HTML, PDF, and XLSX.
• Delegate granular permissions to technicians without elevating their Microsoft 365 privileges and create custom roles with any combination of reporting, management, and auditing tasks.
• Easily manage users, groups, contacts, mailboxes, teams, and sites in bulk without PowerShell scripting.
• Keep tabs on even the most granular user activities in your Microsoft 365 environment.
• Configure alert profiles in M365 Manager Plus to notify you of specific activities that take place outside of business hours or occur at unusual frequencies.
• Monitor the health and performance of Microsoft 365 features and endpoints around the clock.