Fetching Customer Cloud Secure Score Items

Question

Xavier Ibanez-Padron 0

I'm attempting to access customer data from the Microsoft Defender for Cloud Secure Score/Control API using service principal credentials.

However, I'm not receiving any data in response (output 'value' list is empty for every tenant other than our own)

Could anyone provide insights on what specific permissions are required for the service principals to successfully retrieve data from this API?

Any guidance or suggestions would be greatly appreciated.

Below are the specific items I am looking for

cloud

0 comments

1 answer

Answer 1

Marilee Turscak-MSFT 37,391 Microsoft Employee Moderator

To retrieve the properties of a secureScore object, these permissions are required:

Permission type	Least privileged permissions	Higher privileged permissions

Delegated (work or school account)	SecurityEvents.Read.All	SecurityEvents.ReadWrite.All
Delegated (work or school account)	SecurityEvents.Read.All	SecurityEvents.ReadWrite.All
Delegated (personal Microsoft account)	Not supported.	Not supported.
Application	SecurityEvents.Read.All	SecurityEvents.ReadWrite.All

In addition, in the Admin API settings, you should check if you need to set Service principals can access read-only admin APIs to Enabled.

Xavier Ibanez-Padron 0 Reputation points

2024-07-19T16:50:15.7766667+00:00

Hi @Marilee Turscak-MSFT thanks for the response. I am specifically using the Secure Scores - List API. In regards to those 'SecurityEvents.ReadWrite.All' permissions, I have already ensured that the primary service principals being used for each client do indeed have those permissions (as they are listed in the Secure Score - List REST API, which I was using prior to this new cloud one).
Marilee Turscak-MSFT 37,391 Reputation points Microsoft Employee Moderator

2024-07-19T21:21:51.5666667+00:00

Thanks for clarifying, @Xavier Ibanez-Padron . Are you fetching the Secure Score from a Log Analytics workspace? If so, can you try adding Contributor permissions to service principal within the workspace to see if you get the same result?
Xavier Ibanez-Padron 0 Reputation points

2024-07-22T00:32:56.3733333+00:00

Thanks @Marilee Turscak-MSFT . I am not fetching any data from a log analytics workspace. I am fetching via obtaining an Azure Management authentication token (POST API Call - https://login.microsoftonline.com/tenantID/oauth2/v2.0/token) and using that token with the aforementioned endpoint (GET API Call)