search

microsoft / Microsoft365DSC

Manages, configures, extracts and monitors Microsoft 365 tenant configurations
https://aka.ms/M365DSC
MIT License
1.54k stars 472 forks source link

New-M365DSCDeltaReport does not take permission type into account when comparing permissions for Azure Applications #3383

Open PierreColyn opened 1 year ago

PierreColyn commented 1 year ago

It seems that the New-M365DSCDeltaReport command compares Delegated app permissions with Application permissions when both Delegated- and Application permissions exist for a specific permission.

For example, take an app that has a delegated Device.Read.All permissions AND an application Device.Read.All permission:

image

image

AdminConsentGranted is true for the Delegated permission but false for the Application permission.

In both snapshots, the settings are exactly the same.

When the Delta report is run, it reports that AdminConsentGranted has changed from True to False, when in fact it did not change. I suspect that the comparison compares the Delegated and Application permissions and finds the delta. The report should take into account the permission type in the comparison.

image

The delta report should also state if the change is related to Delegated- or Application permissions.

PierreColyn commented 9 months ago

Hello,

Just want to confirm if this issue has been resolved?