syne0 / osprey

Powershell Based tool for gathering information related to O365 intrusions and potential Breaches
MIT License
6 stars 2 forks source link

Users are dropped in the suspicious app list #59

Open randomaccess3 opened 2 weeks ago

randomaccess3 commented 2 weeks ago

https://github.com/syne0/osprey/blob/edb14ce4e8c342c550c664b77cbef6f88dbef75c/Osprey/functions/Tenant/Get-OspreyTenantAppsAndConsents.ps1#L71

If i'm reading this correctly this is going to drop users if there is more than one user assigned to the app. In a case im looking at at the moment there's 2 users assigned to perfectdata software, but only one shown in "Users Assigned"

Same would apply to references, and known permissions