Microsoft Graph Risk Assessment

Question

I would like to complete a risk assessment for Microsoft’s Graph (Gateway). I am looking for guidance on understanding the risks and possible data exfiltration channels when using Microsoft Graph. For example, when using the Microsoft Graph, other than the authorized user does Microsoft and/or other 3rd party having access to the queried data via backend channel? When data is queried by the authorized user, are the results either saved locally or in the MS Graph application? Thanks

Answer 1

Hello @Wagner, Scott to access your data, Microsoft identity platform helps you build applications and provide authorized access to your own APIs or Microsoft APIs like Microsoft Graph. All graph requests require authentication and your application should have the correct permissions. Please see further documentation on secure data access via Graph and best practices.

Data queried by authorized users can be saved locally, so permissions should be carefully tuned to prevent unwanted access. Graph also includes a security API to improve threat protection, detection and response capabilities.

I hope this helps,

Diana.