Detect over-consented apps that use Microsoft Graph<\/h2>\n
Previously, we introduced support for detecting minimal permissions for calling Microsoft Graph APIs. By recording a series of API requests, you can have the Developer Proxy automatically detect what minimal permissions your app needs to call these APIs. This feature is not only great for your productivity, but also helps you build apps that are secure.<\/p>\n
In this version, we continued our work related to minimal permissions and introduce a new plugin which helps you find if your app has more permissions than what it needs (also known as over-consenting).<\/p>\n
Similarly to the minimal permissions plugin we introduced previously, the new plugin uses the Developer Proxy\u2019s recording mode to capture the series of Microsoft Graph API requests issued by your app. When you stop the recording, the plugin will compare the scopes\/roles on the access token with the minimal permissions needed to call the captured APIs and warn you if your token uses more\/broader permissions.<\/p>\n
We compare permissions from the access token with minimal permissions locally and are not uploading your access token to any external API.<\/strong><\/p>\n This new plugin detects over-consenting for both application- and delegated permissions. For more information about how it works, see the documentation<\/a>.<\/p>\n We\u2019re releasing this feature in preview and will continue to improve its accuracy. We\u2019d love to hear feedback on how it works and how we can make it better.<\/p>\n Following our announcement<\/a> in May, we\u2019re releasing this version under the new name of Microsoft 365 Developer Proxy<\/strong>. We hope that it will make it clearer that you can use this tool with Microsoft Graph and any other API on Microsoft 365 and beyond.<\/p>\n As a part of the rename, we renamed the repository<\/a> and moved it to the Microsoft organization on GitHub. We\u2019ve also changed the name of the executable to m365proxy<\/strong> which you\u2019ll now use to start the proxy on your machine.<\/p>\n Download Microsoft 365 Developer Proxy v0.9<\/a> and check if your apps properly handle API errors.<\/p>\n We\u2019re excited about this new version and can\u2019t wait for you to try it out. We look forward to hearing from you<\/a> about these improvements and how we can continue to make the Microsoft 365 Developer Proxy even better.<\/p>\n![\"Terminal](\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2023\/06\/image1.png\")
<\/a><\/p>\nNew name, the same awesome tool<\/h2>\n
Try it now<\/h2>\n