3. Permission-Level Risk Factors

3.1 Purpose

Permission-level risk factors assess the potential impact, privilege depth, and data sensitivity of the individual Microsoft Graph or API permissions an application requests. While application-level scoring focuses on who owns the app and how it is governed, permission-level scoring answers the critical question: “What could this app do if granted access?”

Each permission scope is decomposed into a series of functional characteristics such as:

• Data sensitivity — internal vs. regulated PII
• Action capability — read, write, delete, send
• Operational reach — single-user vs. full-tenant access
• Privilege elevation risk — impersonation, role assignment, or conditional access policy changes

Each risk factor is assigned to one of the four weighted permission-level risk domains described in §1.3: Identity & Privilege Escalation, Access Surface & Blast Radius, Data Sensitivity & Leakage, and Compliance & Trust Heuristics. Raw scores are normalized within their domain, weighted by the domain’s strategic security impact, and combined into a composite permission risk score (0–100), which maps to one of four risk tiers: Low, Medium, High, or Critical.

The model also recognizes Resource-Specific Consent (RSC) where supported. A permission like Mail.Read scoped to a specific mailbox via RSC will score lower than the same permission granted tenant-wide. This ensures that apps using least-privilege consent patterns are treated more favorably in risk calculations, reinforcing modern consent hygiene.

3.2 Resource-Specific Consent (RSC) risk adjustment

The scoring engine explicitly adjusts for modern consent mechanisms such as Resource-Specific Consent, which enables applications to access a limited set of resources rather than tenant-wide datasets. RSC is currently supported for Microsoft Exchange, with scoped variants such as Mail.Read.Shared or Calendars.Read.Shared, which can be constrained to specific mailboxes or calendars through Application Access Policies.

This model recognizes that RSC-based permissions present significantly less risk than their global equivalents because:

• Their operational reach is confined to explicitly assigned resources
• They reduce the potential for accidental overexposure or data exfiltration
• They reflect intentional least-privilege design

As a result, when an application uses RSC-compatible scopes, the following permission-level risk factors are adjusted proportionally:

Risk Factor	Adjustment effect when RSC is present
Permission Breadth	Reduced from tenant-wide to object-level
Exfiltration Potential	Lowered due to limited data exposure surface

3.2.1 Scoring example

Scope	Reach Score	Scope Score	Exfiltration Risk
Mail.Read.All	40	30	30
Mail.Read.Shared via RSC	10	10	10

In this example, the RSC version results in a 65-point reduction in raw scoring, which significantly changes the final tier classification.

3.2.2 Penalty for avoiding RSC

If an app requests a global scope where an RSC alternative exists (for example Mail.Read.All instead of Mail.Read.Shared), the model may assign a higher score to reflect missed least-privilege opportunities. This makes RSC adoption a policy-aligned way to lower consent friction.

3.3 Domain: Identity & Privilege Escalation (40%)

Scopes that let an app impersonate users, assign roles, or elevate privileges.

Risk Factor	Overview and Risk Impact	Risk Scoring
Privilege Depth	Admin depth: group admin, org admin, global admin. Higher admin means higher takeover risk.	Group admin: 20 Org admin: 30 Global: 40
Privilege Elevation	Create, assign, or remove identities or roles. Enables lateral movement.	None: 0 User/group edits: 30 Role assignment: 40
Impersonation Capability	App can act as another user (for example Mail.Send, user_impersonation), obscuring audit trails.	None: 0 Delegated send-as: 15 App-wide / directory-wide: 30–40
App Role Bundles	Broad directory roles bundle many hidden scopes, hindering audit.	No bundle: 0 Limited role: 10 Broad admin role: 20

3.4 Domain: Access Surface & Blast Radius (30%)

How wide and deep a permission reaches once granted.

Risk Factor	Overview and Risk Impact	Risk Scoring
Permission Type	Delegated (user) vs. app-only (daemon). App-only lacks user oversight.	Delegated: 10 Application: 25
Permission Operation	Captures the type and scope of action enabled by the permission (read, write, delete, send, manage). Write and destructive operations carry higher impact than read-only access.	Read: 0 Write / delete: 20 Send / manage: 30
Permission Breadth	Combines access breadth (self, group, tenant) and action type. Wider and more destructive permissions amplify blast radius.	Default — Self: 0 · Single user/object: 10 · Group/org: 20 · Tenant: 40 With RSC — Self: 0 · Single user/object: 5 · Group/org: 10 · Tenant: 20
Access Policy Modification	Changes conditional access policies, group membership, or roles. Highest privilege vector.	None: 0 Group/role edits: 20 CA / policy changes: 40–50
User Breadth	Counts identities affected (one, group, tenant). Larger reach means faster damage.	One: 0 Group: 10 All users: 20

3.5 Domain: Data Sensitivity & Leakage (25%)

The value of the data reachable and the ease with which it can leave.

Risk Factor	Overview and Risk Impact	Risk Scoring
Data Classification	Classifies data (internal, confidential, PII/regulatory). Drives legal and audit risk.	Internal: 15 Confidential: 25 PII / regulated: 40
Exfiltration Potential	Scopes that read, sync, or export data at scale. Higher chance of breach.	Default — No data access / read-self only: 0 · Basic read: 10–20 · Write to collaborative content: 20–30 · Send-as / message delivery: 30–40 · Sync / migration / bulk read-write: 25–40 · Export / tenant-wide exfiltration: 40 With RSC — Basic read: 5–15 · Write to collaborative content: 15–20 · Send-as / delivery scoped to single object: 20–30 · Sync / bulk ops scoped to single site: 15–25 · Export scoped to known object set: 20–30
Token Persistence	Long-lived or refresh tokens persist after compromise.	Short-lived: 10 Refresh: 25 Offline / long-lived: 40

3.6 Domain: Compliance & Trust Heuristics (5%)

Confidence-reducing indicators that signal audit gaps.

Risk Factor	Overview and Risk Impact	Risk Scoring
Legacy API Risk	Uses deprecated or unsupported APIs (for example AAD Graph), lacking modern security.	Modern: 0 Deprecated: 30 Unsupported: 40

---

OARS §3 is derived from the Graph Consent Risk Framework by Khurram Chaudhary. Licensed CC BY 4.0.