RECENTProduct updateAction required
EntitlementManagement.ReadWrite.All
Analysis / inference: Graph now supports EntitlementManagement.ReadWrite.All for creating access package resource requests.
- Published
- 10 Feb 2022, 05:30 AM IST
- Source
- Microsoft Graph changelog · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
The Create accessPackageResourceRequest operation now accepts the EntitlementManagement.ReadWrite.All application permission.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisWhy it matters
Apps can now programmatically create entitlement management resource requests, expanding the attack surface and requiring monitoring for potential privilege‑escalation abuse.
Operational impact
Enables applications to create resource requests without user interaction, so misuse could lead to unauthorized access if the permission is granted to compromised apps.
Section 03 · Recommended actions
- Review all app registrations for EntitlementManagement.ReadWrite.All and remove unnecessary grants
- Enable and verify audit logging for entitlement management operations
- Create a Sentinel detection rule for creation of accessPackageResourceRequest by apps with this permission
What to check
- List of app registrations with EntitlementManagement.ReadWrite.All permission
- Audit logs for accessPackageResourceRequest creation events
Affected scope
ProductsMicrosoft Graph