What the Engine publishes

Generated from the Engine's capability manifest at 1.0.0b10@0c269e9d29d0. No value on this panel is maintained by this site.

Answers
what every user in a tenant may do without asking, and how many accounts hold the role that may do anything
Collector
Microsoft Graph · mode TenantGovernance
Reads
  • GET /v1.0/policies/authorizationPolicy
  • GET /v1.0/policies/authenticationMethodsPolicy (the method configurations are expanded by the service, so this is one read and not one per method)
  • GET /v1.0/roleManagement/directory/roleAssignments ($filter on the Global Administrator template, $select only)
  • GET /v1.0/users/{id}?$select=id,onPremisesSyncEnabled (once per principal, so that no display name is ever received)
Least privilege
  • Policy.Read.All
  • RoleManagement.Read.Directory
  • Policy.Read.AuthenticationMethod
Produces
entra ·authorization-policy
Proven against a tenant
live-validated

Rules that decide from it

  • ENTRA-AUTH-001Guests in this directory can invite further guestsdocumented-guidance
  • ENTRA-AUTH-002Users may consent to applications Microsoft has flagged as riskydocumented-guidance
  • ENTRA-AUTH-003Users cannot read other users, which Microsoft says not to dodocumented-guidance
  • ENTRA-AUTH-004Any user can create a new tenant this organisation does not governdocumented-guidance
  • ENTRA-AUTH-005Anybody with an email address in a verified domain can join this tenantdocumented-guidance
  • ENTRA-AUTH-006The legacy MSOnline PowerShell endpoint is reachable by usersdocumented-guidance
  • ENTRA-GUEST-001Guests are granted the same directory role as membersdocumented-guidance
  • ENTRA-METHOD-001SMS is enabled as an authentication methoddocumented-guidance
  • ENTRA-METHOD-002Voice call is enabled as an authentication methoddocumented-guidance
  • ENTRA-METHOD-003Authentication methods are still governed by the legacy MFA and SSPR policiesdocumented-guidance
  • ENTRA-ROLE-001Five or more accounts hold the role that can do anythingdocumented-limit
  • ENTRA-ROLE-002Fewer than two accounts hold the Global Administrator roledocumented-guidance
  • ENTRA-ROLE-003Every Global Administrator is synchronised from on-premisesdocumented-guidance

Contracts it produces

Every collection writes evidence and an account of itself. The manifest publishes no narrower per-capability list, so this states what it does establish rather than guessing at more.

Source

The Engine's own definition of this collector, at the revision this page was generated from:1.0.0b10@0c269e9d29d0.

Generated from capability-manifest/1.0.0 at 1.0.0b10@0c269e9d29d0, contract 1.0.0b10. Every fact on this page is the Engine's; this site publishes it and does not maintain it.