Closed AlexHimself closed 6 months ago
Yes, the module just requires read unless there is no read only scope permission for a dedicated endpoint. If you decide to not grant them, then just don't grant and the documentation will throw an error and not document the specific section but will continue. The module contains a command to create the app registration for you and also the Application Administrator role for example can be used. If you want to execute the commands on your own and have a list of scopes, then you can follow this script:
I think it's an issue that the required permissions aren't clearly spelled out and that should potentially be a part of the install instructions. Most organizations won't blindly run something needing Global Admin and the act of assigning permissions is a desired step.
In my case, I have a privileged but not global admin account, and our tenant is managed by a 3rd party for SOX requirements, so I need to provide a detailed request of the permissions and things I need as narrowly defined as possible and that request is documented and on file for audit purposes. Requesting a global admin run a PowerShell utility just wouldn't fly.
I found in the advanced usage page the list of scopes, so perhaps including some install steps similar to the following:
Or at least a screenshot like the following that lets you know what to expect. This is a LOT of permissions and is initially uncomfortable, but I do note they're mostly "READ" permissions.