Identity Permissions
Snapshot Microsoft Entra role definitions and Microsoft API permission resources from official Microsoft Graph endpoints, keep the data reviewable in Git, and use the results to explain Sentinel, Defender XDR, and API permission boundaries.
Permission Planes
| Plane | Use for | Read permission |
|---|---|---|
| Microsoft Entra role definitions | Use Microsoft Graph unified RBAC role definitions to inspect built-in directory roles and their allowed resource actions. | RoleManagement.Read.Directory |
| API permission resources | Use service principal metadata to snapshot app roles, delegated OAuth scopes, and resource-specific application permissions exposed by Microsoft APIs. | Application.Read.All |
| Azure RBAC / ARM | Use Azure Resource Manager and Azure RBAC for Sentinel workspaces, Log Analytics, DCRs, Logic Apps, and direct Azure resource access. | Azure RBAC |
| Defender unified RBAC | Use Defender portal roles for activated Defender workloads and selected Sentinel portal/data operations scenarios. | Portal workflow |
Microsoft Graph Endpoints
| Dataset | Endpoint |
|---|---|
| Directory role definitions | GET /roleManagement/directory/roleDefinitions?$select=id,templateId,displayName,description,isBuiltIn,isEnabled,rolePermissions,inheritsPermissionsFrom |
| One API resource service principal | GET /servicePrincipals(appId='{resource-app-id}')?$select=id,appId,displayName,appRoles,oauth2PermissionScopes,resourceSpecificApplicationPermissions |
| Microsoft Graph API permissions | GET /servicePrincipals(appId='00000003-0000-0000-c000-000000000000')?$select=appRoles,oauth2PermissionScopes,resourceSpecificApplicationPermissions |
| Defender for Endpoint API permissions | GET /servicePrincipals(appId='fc780465-2017-40d4-a0c5-307022471b92')?$select=appRoles,oauth2PermissionScopes,resourceSpecificApplicationPermissions |
Curated Security API Resources
| Resource | App ID |
|---|---|
| Microsoft Graph | 00000003-0000-0000-c000-000000000000 |
| WindowsDefenderATP | fc780465-2017-40d4-a0c5-307022471b92 |
| Microsoft Threat Protection | 8ee8fdad-f234-4243-8f3b-15c294843740 |
| Office 365 Management APIs | c5393580-f805-4401-95e8-94b7a6ef2fc2 |
| Microsoft Cloud App Security | 05a65629-4c1b-48c1-a78b-804c4abdd4af |
| MTP Unified RBAC | f31d8a6a-ebe6-4d09-ade3-1fde4b391bdd |
Snapshot Workflow
These imports are explicit maintenance commands, not build steps. Normal site builds do not require tenant secrets or live Microsoft Graph access.
bash
# Authenticate with Azure CLI for Microsoft Graph.
az login
# Snapshot Microsoft Entra role definitions.
npm run import:graph-role-definitions
# Snapshot curated Microsoft security API permission resources.
npm run import:graph-api-permissions
# Review and commit deterministic JSON snapshots.
git diff -- data/generated/graph-role-definitions data/generated/graph-api-permissions
git add data/generated/graph-role-definitions data/generated/graph-api-permissions
git commit -m "Refresh Microsoft Graph permission snapshots"Portable Snippets
Directory role definitions
http
GET https://graph.microsoft.com/v1.0/roleManagement/directory/roleDefinitions?$select=id,templateId,displayName,description,isBuiltIn,isEnabled,rolePermissions,inheritsPermissionsFrom
Authorization: Bearer <graph-token>
Accept: application/jsonAPI permission resource
http
GET https://graph.microsoft.com/v1.0/servicePrincipals(appId='00000003-0000-0000-c000-000000000000')?$select=id,appId,displayName,appRoles,oauth2PermissionScopes,resourceSpecificApplicationPermissions
Authorization: Bearer <graph-token>
Accept: application/json