Skip to content

Security: lokeshm-it/MDCA-MDE-Integration

Security

SECURITY.md

Security Policy

Supported Versions

Version Supported
1.x (current) ✅ Yes

Reporting a Vulnerability

Do not open a public GitHub Issue for security vulnerabilities. Email lokeshkarnam007@gmail.com with subject [SECURITY] MDCA Portfolio Repository. You will receive a response within 72 hours.

Script Security Guidelines

Credential Handling

The scripts in this repository that use the MDCA REST API require a Client ID and Client Secret. These must never be stored in the script files or committed to version control.

Recommended secure storage approaches:

  • Azure Key Vault — Reference secrets via Get-AzKeyVaultSecret at runtime
  • Windows Credential Manager — Get-StoredCredential from the CredentialManager module
  • Environment variables — $env:MDCA_CLIENT_SECRET (set at OS level, not in scripts)
  • SecureString parameter — Pass at runtime via Read-Host -AsSecureString

Scripts in this repository accept ClientSecret as a [SecureString] parameter specifically to prevent accidental plain-text exposure.

Minimum Permissions Principle

MDCA and Graph API app registrations created to run these scripts should have the minimum required permissions only:

Script Required Permissions
Get-MDCADiscoveredApps.ps1 CloudApp-Discovery.Read.All
Get-OAuthApps.ps1 Application.Read.All, DelegatedPermissionGrant.ReadWrite.All
Export-MDCAGovernanceLog.ps1 CloudApp-Discovery.Read.All
Set-AppSanctionStatus.ps1 CloudApp-Discovery.ReadWrite.All

Do not use Global Administrator credentials to run these scripts in production automation.

Script Output Files

The CSV outputs from these scripts contain sensitive information:

  • OAuthApps_*.csv — Lists all third-party apps with access to M365 data; do not store in public repositories
  • MDCADiscoveredApps_*.csv — Lists all cloud apps accessed by users; may contain personal data (user counts)
  • GovernanceLog_*.csv — Audit trail of security actions; treat as security-sensitive

Store all output files in a secured, access-controlled location. Do not upload to SharePoint or Teams channels without restricting access.

MDCA Portal Access

Restrict the Cloud App Security Administrator role in Entra ID to a small group of security personnel. This role can:

  • View all user cloud activity
  • Create and enforce governance policies
  • Ban OAuth apps (immediately revoking access for all users)
  • Export the full Governance Log

Treat this role with the same care as Security Administrator.

References

There aren't any published security advisories