MT.1079: Privileged API permissions on service principals should not remain unused.
| ID | MT.1079 |
| Severity | Medium |
| Suite | Mito |
| Product | Defender |
| Related products | Entra ID |
| Feature | Exposure Management |
| Security area | Applications and workload identities |
| Resource type | ServicePrincipal |
| User impact of fixing | Low |
| Effort to fix | Medium |
| Framework controls | nist-800-53-r5:AC-6 Least Privilege |
| MITRE ATT&CK | T1078.004 |
| Reads from | Microsoft Graph |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Unused privileged permissions should not remain assigned to a service principal because they increase the attack surface and risk of unauthorized access. If these permissions are not required for the application’s functionality, they can be exploited by attackers or misused, leading to potential privilege escalation or data exposure. Removing unnecessary privileged permissions helps maintain a stronger security posture and reduces the likelihood of security incidents.
How to fix
Section titled “How to fix”Review the findings in the Applications inventory in App Governance, and verify that there are no activities or use cases requiring the affected service principal to have assignments to these API permissions. Use hunting of app activities to review access and required permissions.
Mito check. Author: Cloud-Architekt. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.