M365Permissions

[JosL]

hello! You may remember me from OnedriveMapper in the ~2017 - 2020 period (although technically it is still around, I'm happy to say it is dying 🙃)

 

As this forum was THE place people used / discussed it the most, I created an account at the time to better help people with OnedriveMapper, and remembered it just now for something else!

 

Because most of the people here are in EDU, I wanted to share with you that M365Permissions.com is (since recently) free* for ALL UK Public Schools. 

 

M365Permissions.com is basically a tool that helps you identify oversharing in/outside your M365 tenant, it indexes ALL permissions even up to the mailbox folder or powerbi report level. Onenote, Power Automate, Azure, it includes it all and makes it searchable and analyzes it for 'bad' permissions e.g. doing Owner permissions for "Anonymous". (that's actually a real world example from a CEO's mailbox....you wouldn't believe it).

 

Because it has all this permission data, you can also use it for other things such as ISO certifications, audits, offboarding checks (unique permissions is really handy there). And the data is/stays yours and in your tenant, so anything else you can come up with...

 

Hope this helps you! And don't hesitate to shout out if I can improve anything

 

Cheers,

 

Jos.

 

[Roberto]

What a great service. If you'll forgive me making a suggestion you didn't ask for, it might be worth more prominently surfacing the "Privacy & Control: The entire solution is deployed inside your Azure Subscription. No data leaves your tenant. The processing logic, database, and reporting interface reside wholly within the Resource Group you designate." comment.

 

My first thought was for privacy and risk of having lots of "reconnaissance" data all in one place

Edited April 7 by Roberto

[TechMonkey]

Looks a great tool but that is a scary amount of permissions it asks for.

- Read all users' full profiles

- View all content in tenant

- Read, update, and delete all eligible role assignments for your company's directory

- Manage Exchange configuration

Are a few that stick out to me. 

[JosL]

4 minutes ago, TechMonkey said:

Looks a great tool but that is a scary amount of permissions it asks for.

- Read all users' full profiles

- View all content in tenant

- Read, update, and delete all eligible role assignments for your company's directory

- Manage Exchange configuration

Are a few that stick out to me. 

Totally! That is one of the reasons I didn't want to run it for others and have their data/credentials laying around. I wanted to make it as secure by design as possible.

 

If it runs in your tenant, without MI, and the data stays there, you control it. 

 

Since the main tool even surfaces permissions on individual mailbox folders, it does need full access to those mailboxes. Same goes for file-level permission info in e.g. Sharepoint.

I did look into minimizing the Exchange required permissions (the API is dumb), but getting the send-as permissions for e.g. distribution groups actually required Exchange Administrator in the default config 😕 That can be fixed by creating a custom admin role in exchange with a specific assignment, so you can actually run with less permissions, but I don't expect a lot of users will be tech-savvy enough to do or want to do that.