geoffreylagaisse/Hass-Microsoft-Graph

Use of "All" permissions, and application level

Closed this issue · 4 comments

loryanstrant commented

Can I ask why you're stating that the ".All" permissions are required, and why application permissions?
Surely this goes against the principle of least access.
By using that method, the HA user has the ability to see the presence of all users in the tenant - not just their own.

You should only have Presence.Read and User.Read as delegated permissions.

geoffreylagaisse commented

Hi @loryanstrant,

Thanks for pointing this out. I took over this information from the initial developer. I will test the integration out with less permissions and will update the docs when successful.

  • ❤️1
geoffreylagaisse commented

@loryanstrant tested and working! updated the docs

  • 👍1
loryanstrant commented

Heya, just noticed that you're still suggesting people add .All for both User and Presense data (even as delegated) - is this required? It seems unnecessary when it's only supposed to be reading the presense data of the signed in user.
Thanks

geoffreylagaisse commented

You're right, a PR got merged that undid my previous update. Thanks for pointing it out