Medium - Microsoft Graph API, Azure Event Hubs, Microsoft Entra ID, Infrastructure-as-Code using Bicep - Microsoft primary source
Microsoft Graph Permission and Resource Changes - Admin Consent Updates and Bicep Resource Additions
Microsoft Graph updated delegated permissions `FileStorageContainerType.Manage.All` and `FileStorageContainerTypeReg.Manage.All` to no longer require admin consent, while `ThreatSubmission.Read` and `ThreatSubmission.ReadWrite` now require admin consent. Additionally, multiple Microsoft Graph resources such as user, application, servicePrincipal, and others were added for deployment via Bicep templates to support infrastructure-as-code scenarios. Event Hubs authentication via shared access signatures is deprecated in favor of Microsoft Entra ID RBAC.
What changed
Changed admin consent requirements for several delegated permissions; added Bicep resource support for various Microsoft Graph resource types including user, application, servicePrincipal, federatedIdentityCredential, and group; deprecated SAS authentication for Azure Event Hubs in favor of RBAC.
Why it matters operationally
Developers and administrators need to adjust consent processes and update deployment pipelines to incorporate Bicep templates for resource provisioning. Subscriptions to Microsoft Graph change notifications via Event Hubs require migration to Microsoft Entra ID RBAC. Security posture may be improved by stricter admin consent controls on threat submission permissions.
What the SOC should check
Validate affected Microsoft products, confirm whether controls or detections need tuning, and record any change-management or monitoring actions.
Recommended actions
- Review and update consent workflows to accommodate permission changes
- Migrate Event Hubs authentication from SAS to Microsoft Entra ID RBAC as per guidance
- Incorporate Microsoft Graph Bicep resources into infrastructure-as-code deployment processes
- Audit applications using `ThreatSubmission.Read` and `ThreatSubmission.ReadWrite` for admin consent compliance
- Familiarize with new resource deployment options to automate Microsoft Graph resource management