Skip to content

Commit d32cf4c

Browse files
merillmerill
committed
Added macos support
1 parent 72ca75e commit d32cf4c

File tree

2 files changed

+33
-18
lines changed

2 files changed

+33
-18
lines changed

‎assets/aadconsentgrantpermissiontable.csv‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,10 @@ Delegated,Contacts,High,Phishing
55
Delegated,MailboxSettings,High,Phishing
66
Delegated,People,High,Phishing
77
Delegated,Files,High,Phishing
8+
Delegated,AllSites,High,Phishing
89
Delegated,Notes,High,Phishing
10+
Delegated,Policy,High,Phishing
11+
Delegated,AppRoleAssignment.ReadWrite.All,High,Phishing
912
Delegated,Directory.AccessAsUser.All,High,Phishing
1013
Delegated,user_impersonation,High,Phishing
1114
Delegated,Application.ReadWrite.All,High,BroadImpact
@@ -15,14 +18,24 @@ Delegated,EduRoster.ReadWrite.All,High,BroadImpact
1518
Delegated,Group.ReadWrite.All,High,BroadImpact
1619
Delegated,Member.Read.Hidden,High,BroadImpact
1720
Delegated,RoleManagement.ReadWrite.Directory,High,BroadImpact
21+
Delegated,RoleAssignmentSchedule.ReadWrite.Directory,High,BroadImpact
22+
Delegated,RoleEligibilitySchedule.ReadWrite.Directory,High,BroadImpact
1823
Delegated,User.ReadWrite.All,High,BroadImpact
1924
Delegated,User.ManageCreds.All,High,BroadImpact
25+
Delegated,User.Export.All,High,BroadImpact
2026
Application,Mail,High,Phishing
2127
Application,Contacts,High,Phishing
2228
Application,MailboxSettings,High,Phishing
2329
Application,People,High,Phishing
2430
Application,Files,High,Phishing
31+
Application,Sites,High,Phishing
32+
Application,AllSites,High,Phishing
2533
Application,Notes,High,Phishing
34+
Application,Policy,High,BroadImpact
35+
Application,PrivilegedAccess,High,BroadImpact
36+
Application,PrivilegedAssignmentSchedule,High,BroadImpact
37+
Application,PrivilegedEligibilitySchedule,High,BroadImpact
38+
Application,AppRoleAssignment.ReadWrite.All,High,Phishing
2639
Application,Directory.AccessAsUser.All,High,Phishing
2740
Application,user_impersonation,High,Phishing
2841
Application,Application.ReadWrite.All,High,BroadImpact
@@ -31,12 +44,14 @@ Application,Domain.ReadWrite.All,High,BroadImpact
3144
Application,EduRoster.ReadWrite.All,High,BroadImpact
3245
Application,Group.ReadWrite.All,High,BroadImpact
3346
Application,Member.Read.Hidden,High,BroadImpact
47+
Application,UserAuthenticationMethod.ReadWrite.All,High,BroadImpact
3448
Application,RoleManagement.ReadWrite.Directory,High,BroadImpact
3549
Application,User.ReadWrite.All,High,BroadImpact
3650
Application,User.ManageCreds.All,High,BroadImpact
51+
Application,CallRecords.Read.All,High,SensitiveData
3752
Delegated,User.Read,Low,Common pattern
3853
Delegated,User.ReadBasic.All,Low,Common pattern
39-
Delegated,open_id,Low,Common pattern
54+
Delegated,openid,Low,Common pattern
4055
Delegated,email,Low,Common pattern
4156
Delegated,profile,Low,Common pattern
4257
Delegated,offline_access,Low,Common pattern when used with other low permissions

‎src/Export-MsIdAppConsentGrantReport.ps1‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@ function Export-MsIdAppConsentGrantReport {
2727
[CmdletBinding(DefaultParameterSetName = 'Download Permissions Table Data',
2828
SupportsShouldProcess = $true,
2929
PositionalBinding = $false,
30-
HelpUri = 'http://www.microsoft.com/',
3130
ConfirmImpact = 'Medium')]
3231
[Alias()]
3332
[OutputType([String])]
@@ -60,6 +59,8 @@ function Export-MsIdAppConsentGrantReport {
6059
$Path
6160
)
6261

62+
$autoSize = $IsWindows # AutoSize of columns only works on Windows
63+
6364
# Delete the existing output file if it already exists
6465
$OutputFileExists = Test-Path $Path
6566
if ($OutputFileExists -eq $true) {
@@ -134,23 +135,23 @@ function Export-MsIdAppConsentGrantReport {
134135

135136
$excel = $data | Export-Excel -Path $Path -WorksheetName ConsentGrantData `
136137
-PivotTableDefinition $pt `
137-
-AutoSize `
138+
-AutoSize:$autoSize `
138139
-Activate `
139140
-HideSheet "None" `
140141
-UnHideSheet "PermissionsByPrivilegeRating" `
141142
-PassThru
142143

143-
# Create temporary Excel file and add High Privilege Users sheet
144-
$xlTempFile = "$env:TEMP\ImportExcelTempFile.xlsx"
145-
Remove-Item $xlTempFile -ErrorAction Ignore
146-
$exceltemp = $highprivilegeusers | Export-Excel $xlTempFile -PassThru
147-
Add-Worksheet -ExcelPackage $excel -WorksheetName HighPrivilegeUsers -CopySource $exceltemp.Workbook.Worksheets["Sheet1"]
148144

149-
# Create temporary Excel file and add High Privilege Apps sheet
150-
$xlTempFile = "$env:TEMP\ImportExcelTempFile.xlsx"
145+
$xlTempFile = [system.io.path]::GetTempFileName()
146+
$exceltemp = $highprivilegeusers | Export-Excel $xlTempFile -PassThru
147+
Add-Worksheet -ExcelPackage $excel -WorksheetName HighPrivilegeUsers -CopySource $exceltemp.Workbook.Worksheets["Sheet1"] | Out-Null
151148
Remove-Item $xlTempFile -ErrorAction Ignore
149+
150+
Write-Verbose "Create temporary Excel file and add High Privilege Apps sheet"
151+
$xlTempFile = [system.io.path]::GetTempFileName()
152152
$exceltemp = $highprivilegeapps | Export-Excel $xlTempFile -PassThru
153-
Add-Worksheet -ExcelPackage $excel -WorksheetName HighPrivilegeApps -CopySource $exceltemp.Workbook.Worksheets["Sheet1"] -Activate
153+
Add-Worksheet -ExcelPackage $excel -WorksheetName HighPrivilegeApps -CopySource $exceltemp.Workbook.Worksheets["Sheet1"] -Activate | Out-Null
154+
Remove-Item $xlTempFile -ErrorAction Ignore
154155

155156
$sheet = $excel.Workbook.Worksheets["ConsentGrantData"]
156157
Add-ConditionalFormatting -Worksheet $sheet -Range "A1:N1048576" -RuleType Equal -ConditionValue "High" -ForeGroundColor White -BackgroundColor Red -Bold -Underline
@@ -159,11 +160,11 @@ function Export-MsIdAppConsentGrantReport {
159160

160161
$sheet = $excel.Workbook.Worksheets["HighPrivilegeUsers"]
161162
Add-ConditionalFormatting -Worksheet $sheet -Range "B1:B1048576" -RuleType Equal -ConditionValue "High" -ForeGroundColor White -BackgroundColor Red -Bold -Underline
162-
Set-ExcelRange -Worksheet $sheet -Range A1:C1048576 -AutoSize
163+
Set-ExcelRange -Worksheet $sheet -Range A1:C1048576 -AutoSize:$autoSize
163164

164165
$sheet = $excel.Workbook.Worksheets["HighPrivilegeApps"]
165166
Add-ConditionalFormatting -Worksheet $sheet -Range "B1:B1048576" -RuleType Equal -ConditionValue "High" -ForeGroundColor White -BackgroundColor Red -Bold -Underline
166-
Set-ExcelRange -Worksheet $sheet -Range A1:C1048576 -AutoSize
167+
Set-ExcelRange -Worksheet $sheet -Range A1:C1048576 -AutoSize:$autoSize
167168

168169
Export-Excel -ExcelPackage $excel | Out-Null
169170
Write-Verbose ("Excel workbook {0}" -f $ExcelWorkbookPath)
@@ -207,6 +208,7 @@ function Export-MsIdAppConsentGrantReport {
207208

208209
# Get all ServicePrincipal objects and add to the cache
209210
Write-Verbose "Retrieving ServicePrincipal objects..."
211+
Write-Progress -Activity "Retrieving ServicePrincipal objects..."
210212
$servicePrincipals = Get-MgServicePrincipal -ExpandProperty "appRoleAssignedTo" -All:$true
211213
$Oauth2PermGrants = @()
212214

@@ -216,7 +218,7 @@ function Export-MsIdAppConsentGrantReport {
216218
$spPermGrants = Get-MgServicePrincipalOauth2PermissionGrant -ServicePrincipalId $sp.Id -All:$true
217219
$Oauth2PermGrants += $spPermGrants
218220
$count++
219-
Write-Progress -Activity "Retrieving Delegate Permissions..." -Status "Cached: $count of $($servicePrincipals.Count)" -PercentComplete (($count / $servicePrincipals.Count) * 100)
221+
Write-Progress -Activity "Retrieving Delegate Permissions..." -Status "$count of $($servicePrincipals.Count)" -PercentComplete (($count / $servicePrincipals.Count) * 100)
220222
}
221223

222224
# Get one page of User objects and add to the cache
@@ -275,7 +277,7 @@ function Export-MsIdAppConsentGrantReport {
275277
}
276278

277279
# Iterate over all ServicePrincipal objects and get app permissions
278-
Write-Progress -Activity "Processing Application Permission Grants..."
280+
Write-Progress -Activity "Retrieving Application Permissions..."
279281
$servicePrincipals | ForEach-Object {
280282
$sp = $_
281283

@@ -402,16 +404,14 @@ function Export-MsIdAppConsentGrantReport {
402404

403405
if ($null -like $PermissionsTableCsvPath) {
404406
# Create hash table of permissions and permissions privilege
405-
Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/AzureAD/MSIdentityTools/main/assets/aadconsentgrantpermissiontable.csv' -OutFile .\aadconsentgrantpermissiontable.csv
406-
$permstable = Import-Csv .\aadconsentgrantpermissiontable.csv -Delimiter ','
407+
$permstable = Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/AzureAD/MSIdentityTools/main/assets/aadconsentgrantpermissiontable.csv' | ConvertFrom-Csv -Delimiter ','
407408
}
408409
else {
409410

410411
$permstable = Import-Csv $PermissionsTableCsvPath -Delimiter ','
411412
}
412413

413414
Write-Output $permstable
414-
415415
}
416416

417417
if ("ExcelWorkbook" -eq $ReportOutputType) {

0 commit comments

Comments
 (0)