microsoft / aad-app-credential-tools

Tooling for application credentials
MIT License
21 stars 23 forks source link

Update CVE-2021-42306-AutomationAssessAndMitigate.ps1 #13

Open Ch4rliePL opened 3 years ago

Ch4rliePL commented 3 years ago

Updated the code to include next page query for getting all automation accounts, as if more than 1000 accounts are accessible to current user, they are not added to collection. Using top = 10000 didn't work as result set cannot exceed maximum value of 1000 returned records: https://docs.microsoft.com/en-us/azure/governance/resource-graph/concepts/work-with-data#paging-results

Execution of Get-AzAccessToken cmdlet was moved from beginning of the script to Make-MSGraphRequest function to ensure access token is being refreshed. In other case script is failing if it is running for more than 1 hour (beyond the lifetime of the initially obtained access token), as there is no validation if access token is not expired.

ghost commented 3 years ago

CLA assistant check
All CLA requirements met.