Develop and execute adversary emulation tests on high-risk service principal permissions

[mitchelbaker-cisa]

💡 Summary

Refer to this list of high-risk service principal permissions. Determine the risk associated with assigning these permissions to a service principal, and determine what a malicious actor would have access to within an M365 environment.

Motivation and context

Associated with #1073 and builds on prototyping work for #1327.

Implementation notes

Use this issue as a reference point for reporting on information found.

Acceptance criteria

How do we know when this work is done?

• The actual risks with each permission are determined, the list of high-risk service principal permissions is expanded upon or modified to reflect these updates.