ZCSPM
Granting Admin Consent for Microsoft Graph API Permissions
To grant admin consent for Microsoft Graph API permissions:
- Log in to the Azure Portal
- In the left-pane menu, click Azure Active Directory.
- Select App registrations, then select the ZCSPM application which you want to onboard.
- In the left-pane menu, click API permissions.
- Click Add a permission, then select Microsoft Graph.
- Click Application permissions, then select the Directory.read.all permission.
- Click Add permissions.
- Click Grant admin consent.
You can grant the ZCSPM Azure app Microsoft Graph API's Directory.read.all permission to get the following 5 security policies:
| Policy Title | Required Azure AD Entity | Data Stored at ZCSPM |
|---|---|---|
| Ensure that AD Application keys are rotated before they expires | passwordCredentials Metadata information contained within the data entity will be key start-date, end-date, and expiry policies. No actual values are retrievable. |
|
| Ensure that Service Principal Certificate are renewed before it expires | keyCredentials Metadata information contained within the data involves start-date and end-date. Refer to documentation here. |
|
| Ensure that there are no guest users | userType Member or guest. |
No data is stored in the ZCSPM database. This policy only retrieves the count of total users and guest users. |
| Enforce the policy to set Password to ‘always’ expire in Azure Active Directory for all Organization Users | passwordPolicies Metadata involving the length of the password, password strength, and password restrictions. Refer to documentation here. |
No data is stored in the ZCSPM database. This policy only retrieves the count of all organization users and how many of them have set ‘Password always expired’ to ‘On’. |
| Ensure that Azure resources are accessible only through Organization Account | userType Member or guest. |
No data is stored in the ZCSPM database. This policy only retrieves the count of external users in an organization who can access resources under the Azure Subscription. |