Delegated user auth support for the MDATPDriver
#783
Comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
{{ message }}
Delegated user auth support for the
Context
Defender changed how it handles API permissions multiple times in the recent past, so the
MDATPDriveris responsible for selecting the correct resource, scope name, API URI, and login URI:AdvancedQuery.Readhttps://api.securitycenter.microsoft.com/advancedqueries/runhttps://login.microsoftonline.com/<tenantId>/oauth2/tokenMDE,MDATPAdvancedHunting.Readhttps://api.security.microsoft.com/advancedhunting/runhttps://login.microsoftonline.com/<tenantId>/oauth2/tokenM365DThreatHunting.Read.Allhttps://graph.microsoft.com/<version>//security/runHuntingQueryhttps://login.microsoftonline.com/<tenantId>/oauth2/v2.0/tokenM365DGraphThe
msticpy.data.drivers.mdatp_driver.MDATPDriveris a subclass ofmsticpy.data.drivers.odata_driver.ODatawith a few key differences. TheMDATPDriverclass only allows confidential client credential auth flows using a secret, while itsODataparent class supports both application and delegated user auth flows. This is because the Defender APIs previously did not allow delegated user auth. TheMDATPDriverdriver also determines the correct casing on some of the field names in the responses.Problem
The current
MDATPDriverclass only supports authentication using a client secret and application permissions. The use of secrets is not allowed per the Secure Future Initiative.Proposed Solution
Update the
MDATPDriverclass to allow delegated user authentication.msticpyconfig.yamlpermitsMicrosoftDefender.Argswithout a definedClientSecretmsticpy.data.drivers.mdatp_driver.MDATPDriverto support delegated user authThe text was updated successfully, but these errors were encountered: