briandelmsft / SentinelAutomationModules

The Microsoft Sentinel Triage AssistanT (STAT) enables easy to create incident triage automation in Microsoft Sentinel
MIT License
212 stars 58 forks source link

[BUG] GrantPermissions.ps1 script is missing a permission scope #358

Closed piaudonn closed 1 year ago

piaudonn commented 1 year ago

Describe the bug The GrantPermissions.ps1 script is failing if the Microsoft Graph PowerShell service principal doesn't have the Application.Read.All permission.

Module Name The latest permission script.

To Reproduce Steps to reproduce the behavior:

  1. Make sure the Microsoft Graph PowerShell doesn't exist in the tenant, or that it doesn't have the scope permissions Application.Read.All.
  2. Run the script with the recommended roles.
  3. Here is the error message in the script's output:
    Get-MgServicePrincipal : Insufficient privileges to complete the operation.
    At line:81 char:5
    +     Get-MgServicePrincipal -Filter "displayName eq '$AppName'"
    +     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: ({ ConsistencyLe...ndProperty =  }:<>f__AnonymousType27`9) [Get-MgServicePrincipal_List1], RestExcepti 
    on`1
    + FullyQualifiedErrorId : Authorization_RequestDenied,Microsoft.Graph.PowerShell.Cmdlets.GetMgServicePrincipal_List1
    ❌ Principal not found.

Additional context Kudos to @Andrew-Bennett #356 see PR for fix.