Check if you're using excessive Microsoft Graph API permissions

Microsoft Graph exposes hundreds of endpoints that allow you to tap into data and insights in Microsoft 365. To use these API endpoints, you need to request a correct set of permissions.

A common approach to security is to apply the principle of least privilege (PoLP). This principle applies to users, processes, and programs.

To check if your app is using more permissions than it needs:

1. Enable the GraphMinimalPermissionsGuidancePlugin plugin.
2. Start recording.
3. Use your app to issue requests as normal.
4. Stop recording.

Dev Proxy returns a list of permissions scopes that are unnecessary in the activity summary based on the intercepted requests.

For example:

Evaluating delegated permissions for:

- GET /me

Permissions on the token:
AllSites.FullControl, User.Read

    WARNING: The following permissions are unnecessary:
    WARNING: AllSites.FullControl