A compost-tracking app registration lists Directory.ReadWrite.All delegated and Sites.ReadWrite.All application permissions “just in case.” What should the security engineer do?
Select an answer to reveal the explanation.
Short Explanation
“Just in case” Graph permissions are spare master keys on a keyring you do not need. Trim to the least scopes the compost app actually uses—directory-wide read/write is not a default souvenir.
Full Explanation
Least-privilege practice on app registrations means requesting only the Microsoft Graph (or other API) permissions required for the workload. Broad directory and SharePoint write permissions expand blast radius if the app or its credentials are abused. Converting delegated permissions to application permissions usually increases privilege rather than reducing it. PIM role settings are separate from trimming Graph scopes on a registration.