AS-Revoke-Azure-AD-User-Session- Playbooks should use lower privilege

[jkerai1]

User.ReadWrite.All was previously required but we have User.RevokeSessions.All now which is least privilege option

https://learn.microsoft.com/en-us/graph/api/user-revokesigninsessions?view=graph-rest-1.0&tabs=http

[jkerai1]

Same endpoint

[jkerai1]

Affected Playbooks:

AS-Revoke-Azure-AD-User-Session-From-Entity

AS-Revoke-Azure-AD-User-Session-From-Incident

[v-visodadasi]

Hi @jkerai1 , Could you please provide more details?

[jkerai1]

@v-visodadasi

The app reg here should be using User.RevokeSessions.All not User.ReadWrite.All

See Least Privilege Table here: https://learn.microsoft.com/en-us/graph/api/user-revokesigninsessions?view=graph-rest-1.0&tabs=http#permissions