My application doesn't seem to have all the permissions showed in Azure Portal

Question

I have a Microsoft Defender ATP application that has "Microsoft threat protection.
AdvancedHunting.Read.All" however, when I'm trying to reach the following endpoint: https://api.security.microsoft.com/api/advancedhunting I'm encountering an error that claims I don't have the permission mentioned above.
Also, Putting my bearer token on JWT yields the same result - the permission is missing..
Any idea why I can't see this permission as part of my token's permissions?

Answer 1

AdvancedHunting.Read.All is an application permission, meaning you need to obtain a token via the client credentials flow. If you are using the any of the flows corresponding to delegate permission flows, you will not see it reflected in the token.

Similarly, make sure you are using the correct endpoint when obtaining the token, i.e. if your app is leveraging multiple APIs/resources, you will have to request a token for each of them separately.

Answer 2

I'm working with client creds flow so I'm expecting to get app permissions.
The thing is, I'm trying to execute queries (for example: "AlertInfo | limit 1") Via https://api.securitycenter.microsoft.com/api/advancedqueries but i'm failing with the following error: "Failed to resolve table or column expression named 'AlertInfo'. Fix semantic errors in your query."
Doing some research online I found that either my issue is with missing permissions or there's a known issue with not all tables being supported Via the URL mentioned above and that I should try this URL instead: https://api.security.microsoft.com/api/advancedhunting.
I believe the second option is my issue since I'm able to hunt other tables.
So..

1. If you know anything about this issue and can confirm this should solve the issue that would be great!
2. Do you have any guide about how to the API mentioned above to my app permissions that would be helpful because I couldn't find any guide myself.

Answer 3

Hi @itay4

You may not have granted AdvancedHunting.Read.All permission to the application. Note that you need to grant this permission under the Microsoft Threat Protection resource, not the Microsoft Graph resource.

On your application page, select API Permissions > Add permission > APIs my organization uses >, type Microsoft Threat Protection, and select Microsoft Threat Protection.

See: How to access Microsoft 365 Defender in application-only context.

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.