You are reviewing Azure Service Principals in your cloud environment using the CrowdStrike CIEM/Identity Analyzer. Which of the following scenarios indicates a risky Service Principal?

Question

Options

• AA Service Principal with unused "Owner" role permissions for the past 90 days.
• BA Service Principal with "Reader" role assigned and limited to a specific resource group.
• CA Service Principal configured with a client secret that expires in 30 days.
• DA Service Principal with "Monitoring Reader" access for Azure Monitor.

• A
  77% (40)
• B
  6% (3)
• C
  4% (2)
• D
  13% (7)

Explanation

Option A: A Service Principal with the "Owner" role has high-privilege permissions. If these permissions are unused for an extended period, they represent a potential security risk due to unnecessary privilege exposure. Best practices recommend removing or reducing such permissions to align with the principle of least privilege. Option B: This configuration aligns with the principle of least privilege. The "Reader" role provides read-only access and does not allow changes to resources, making it a low-risk setup. Option C: While client secret expiration is an important consideration, an expiration window of 30 days is reasonable and aligns with secure practices. This is not inherently risky unless secrets are set to never expire. Option D: The "Monitoring Reader" role provides restricted access to monitoring data and does not allow changes to resources. This configuration is low-risk and aligned with best practices for read-only access.

No community discussion yet for this question.