Appearance
Ops-Automation Least Privilege Report
Audit date: April 15, 2026 Scope: ops-automation pipeline — all Azure AD app registrations, API keys, GitHub tokens, Telegram bot Stories: LPRIV-010 through LPRIV-016
See Detailed Audit for per-story evidence.
Identities in Scope
| Identity | Type | Used By |
|---|---|---|
kobe-security-audit | Azure AD app registration | Maester, pim-audit, HIPAA audits, dashboards |
| Cortex XDR API key | API key pair | cortex-weekly-report.yml + cortex_agent.py |
SES via github-deploy-main | AWS IAM role | All email-reporting workflows |
cirius-kobe-bot | GitHub user (member) | Automated PRs and branch management |
| Telegram bot token | Bot API token | SecOps platform notifications |
Current State
kobe-security-audit — M365 Security Audit Identity
This app registration is shared across all M365 security audit workflows. It uses GitHub Actions OIDC federated credentials (no stored secrets in GitHub Secrets).
Consented permissions: 27 total — 24 Microsoft Graph (mostly read-only), 1 Exchange Online (Exchange.ManageAsApp), 2 Windows Defender ATP (read-only).
| Status | Permissions |
|---|---|
| ✅ Required | 24 read-only Graph permissions (Maester, PIM, Intune, Defender coverage) |
| ✅ Required | Machine.Read.All, Vulnerability.Read.All (Windows Defender ATP) |
| ✅ Justified | Exchange.ManageAsApp (required for Maester Exchange connectivity; read-only usage) |
| ✅ Removed | Mail.ReadWrite — removed 2026-04-15 (LPRIV-018); email delivery uses SES |
| ✅ Removed | Mail.Send — removed 2026-04-15 (LPRIV-018); confirmed unused |
Cortex XDR API Key
Used for read-only operations: endpoint inventory, incidents, vulnerabilities, alerts. Key is stored in Key Vault cirius-openai-kv-prod. Role assigned in Cortex XDR console is unverified — requires console access to confirm.
SES Sending Identity
Email delivery uses AWS SES via the github-deploy-main management account role (AdministratorAccess — tracked as LPRIV-009 finding). No separate SES-scoped role exists. cirius-acs-smtp (Azure AD) is used for ACS SMTP relay separately; it has zero Graph permissions.
cirius-kobe-bot GitHub Token
Org member (not owner). Write access to repos for branch and commit operations. Branch protection prevents self-merge. No admin access.
Telegram Bot Token
No granular API scope isolation exists in the Telegram Bot API. Architectural control: bot only sends notifications (sendMessage, editMessageText, sendReaction) — no admin, delete, or write operations. Access limited to channels where bot is explicitly added.
Delta — What Needs to Change
| Change | Priority | Story | Status |
|---|---|---|---|
Remove Mail.ReadWrite from kobe-security-audit | HIGH | LPRIV-018 | ✅ Done 2026-04-15 |
Remove Mail.Send from kobe-security-audit | HIGH | LPRIV-018 | ✅ Done 2026-04-15 |
| Verify Cortex XDR API key role = Viewer (read-only) | MEDIUM | LPRIV-013 | Pending Rory console access |
| No changes needed for remaining identities | — | — | — |
SOC2 / HIPAA Mapping
| Control | Requirement | Finding |
|---|---|---|
| HIPAA §164.312(a)(1) — Access control | Least privilege for all service identities | Mail.ReadWrite gap identified — remediation tracked |
| SOC2 CC6.3 — Least privilege | Access limited to what is necessary | kobe-security-audit: 24/27 permissions justified; 1 flagged |
| SOC2 CC6.1 — Logical access | Access control policy enforced | GitHub token and Telegram bot are correctly scoped |
Document History
| Date | Change | Author |
|---|---|---|
| April 2026 | Initial report — LPRIV-010 through LPRIV-016 | Kobe |