Add MT.1186: Require explicit assignment for high-privilege first-party Entra apps

[BakkerJan]

Summary

Adds Test-MtHighPrivilegeServicePrincipalsForAllUsers (MT.1186, High severity), which checks appRoleAssignmentRequired on a curated list of 9 high-privilege, first-party Microsoft service principals:

• Microsoft Azure PowerShell
• Microsoft Azure CLI
• Microsoft Graph Command Line Tools (backs Connect-MgGraph and the Microsoft Graph CLI)
• Graph Explorer
• Azure Active Directory PowerShell (legacy)
• Microsoft Teams PowerShell Cmdlets
• Microsoft Exchange Online PowerShell
• Microsoft SharePoint Online Management Shell
• Power Platform CLI (pac)

These apps are pre-consented in most tenants and carry broad delegated permissions (e.g. Directory.AccessAsUser.All, Application.ReadWrite.All, Group.ReadWrite.All, or full workload-admin impersonation for Exchange/SharePoint). Left open to all users, any compromised or malicious account can use them without any further consent prompt to enumerate directory data or administer that workload directly — a common first step in privilege escalation and data exfiltration.

This is distinct from the existing MT.1075 (Test-MtServicePrincipalsForAllUsers), which explicitly excludes Microsoft-owned apps via appOwnerOrganizationId filtering. MT.1186 targets exactly the Microsoft-owned apps that MT.1075 skips.

The app list and their granted delegated scopes were verified against Microsoft's own first-party app reference and cross-checked with Dirk-jan Mollema's ROADtools first-party scopes dataset rather than relying on memory, since incorrect app IDs would make the check useless.

The result table splits flagged apps ("Open to all users") from the rest ("Other monitored apps") so the actionable items surface first, and links each app to its Entra admin center Properties blade with a hover tooltip explaining the specific risky permission it holds. Apps not provisioned in a given tenant are reported as "Not present in tenant" rather than silently skipped.

Reserved via #697 (comment).

Test plan

• Invoke-ScriptAnalyzer against the new function file — no issues
• ./build/Build-LocalMaester.ps1 — builds and loads cleanly
• ./powershell/tests/pester.ps1 — full QA suite, no failures
• Ran Invoke-Maester -Tag "MT.1186" against a live tenant — confirmed pass/fail/skip states render correctly

Reference

• Verify first-party Microsoft applications in sign-in reports | Microsoft Learn

Summary by CodeRabbit

• New Features
  • Added a new Maester cmdlet to test first-party high-privilege Entra service principals for tenant-wide (“all users”) sign-in configuration and report findings.
  • Added corresponding markdown documentation with remediation steps and output formatting.
  • Exported the new check for use in Maester runs.
• Tests
  • Added a high-severity automated test (MT.1186) and configuration entry to enforce explicit app-role assignment for the monitored applications.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 37052a38-f895-4227-ab27-41a16c245b41

📥 Commits

Reviewing files that changed from the base of the PR and between e34c0dd and 3ed9f1a.

📒 Files selected for processing (1)

• powershell/public/maester/entra/Test-MtHighPrivilegeServicePrincipalsForAllUsers.ps1

🚧 Files skipped from review as they are similar to previous changes (1)

• powershell/public/maester/entra/Test-MtHighPrivilegeServicePrincipalsForAllUsers.ps1

---

📝 Walkthrough

Walkthrough

Changes

High-Privilege Service Principal Test

Layer / File(s)	Summary
Service principal check and module exposure powershell/public/maester/entra/Test-MtHighPrivilegeServicePrincipalsForAllUsers.ps1, powershell/Maester.psd1, powershell/public/maester/entra/Test-MtHighPrivilegeServicePrincipalsForAllUsers.md	Adds a Microsoft Graph check for monitored high-privilege first-party service principals that do not require app role assignment, exports the function, and documents remediation.
Test registration and assertion tests/maester-config.json, tests/Maester/Entra/Test-MtHighPrivilegeServicePrincipalsForAllUsers.Tests.ps1	Registers MT.1186 as a high-severity test and asserts the check returns $true.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: enhancement, maester-test

Suggested reviewers: merill

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the main change: adding MT.1186 for explicit assignment on high-privilege Entra apps.
Description check	✅ Passed	The description follows the template well, covering summary, test plan, and reference with sufficient implementation detail.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@powershell/public/maester/entra/Test-MtHighPrivilegeServicePrincipalsForAllUsers.ps1`:
- Around line 79-85: Update the $isOpen and status logic in
Test-MtHighPrivilegeServicePrincipalsForAllUsers so appRoleAssignmentRequired is
evaluated independently of accountEnabled and disabled service principals with
assignment disabled cannot pass as “Assignment required.” Preserve open-to-all
detection for enabled principals, and report disabled principals with a distinct
non-compliant status when appropriate.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 9d15dca5-77df-43f2-a136-74cd7b253bee

📥 Commits

Reviewing files that changed from the base of the PR and between c2e32d9 and e34c0dd.

📒 Files selected for processing (5)

• powershell/Maester.psd1
• powershell/public/maester/entra/Test-MtHighPrivilegeServicePrincipalsForAllUsers.md
• powershell/public/maester/entra/Test-MtHighPrivilegeServicePrincipalsForAllUsers.ps1
• tests/Maester/Entra/Test-MtHighPrivilegeServicePrincipalsForAllUsers.Tests.ps1
• tests/maester-config.json

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}