Security of MSPortal's Microsoft apps

​

The apps

​

What the apps can access

​

MSPortal.ai Integration: application permissions

​

MSPortal.ai Integration: delegated permissions

​

Calendar app

​

How MSPortal protects the apps

• Read-only access. The apps hold no permission to assign roles, change applications or service principals, or add credentials, so the app can’t raise its own privileges or plant credentials in your tenant.
• App instance property lock is on for both apps, for all properties, in every tenant. Nobody can add credentials to MSPortal’s service principal inside your tenant.
• Dedicated tenant. The app registrations live in an Entra tenant used for nothing else, with administrative access limited to a single administrator, protected by phishing-resistant passkeys.
• Secret rotation every six months, inside Microsoft’s recommendation of less than 12 months. If a compromise is suspected, MSPortal rotates within an hour; you don’t need to do anything, because your consent is granted to the app, not to a particular secret.
• Credential monitoring every 10 minutes. An automated check alerts MSPortal when either app gains, or has replaced, a secret, certificate or federated credential, or requests or is granted a permission outside its approved list.
• Notification. MSPortal notifies affected MSPs within 24 hours of becoming aware of a compromise of these apps. Report a concern to security@msportal.ai.

​

Where sign-ins appear, and the expected sources

• Service principal sign-ins are MSPortal.ai Integration syncing your data. They all come from your MSP’s MSPortal region:

  MSPortal region	Source range
  US	5.60.65.64/26
  EU	3.40.0.32/27

  A service principal sign-in by MSPortal.ai Integration from outside your region’s range is not MSPortal.
• User sign-ins for the same app are people signing in to MSPortal with Microsoft, and the admin approving a tenant connection. They come from each person’s own location.
• The calendar app also signs in from MSPortal’s web hosting, which doesn’t use fixed addresses, so it has no fixed range.

​

Steps you can take

​

Alert on sign-ins from outside the expected range

AADServicePrincipalSignInLogs
| where AppId == "78668eb2-8553-4d0c-ae67-a55462892a3c"
| where not(ipv4_is_in_range(IPAddress, "5.60.65.64/26"))   // US region; use "3.40.0.32/27" for EU
| project TimeGenerated, IPAddress, Location, ResultType, ServicePrincipalName

​

Alert on changes to MSPortal’s app in your tenant

AuditLogs
| where OperationName in (
    "Add service principal credentials",
    "Add app role assignment to service principal",
    "Add delegated permission grant",
    "Update service principal")
| where TargetResources has "MSPortal.ai Integration"
| project TimeGenerated, OperationName, InitiatedBy, TargetResources

​

Review what you’ve granted

​

Remove permissions MSPortal no longer uses

Connect-MgGraph -TenantId "<your tenant ID>" -Scopes "Application.Read.All","AppRoleAssignment.ReadWrite.All","DelegatedPermissionGrant.ReadWrite.All"

$msportal = Get-MgServicePrincipal -Filter "appId eq '78668eb2-8553-4d0c-ae67-a55462892a3c'"
$graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"

# Application permission: SecurityEvents.ReadWrite.All
$role = $graph.AppRoles | Where-Object { $_.Value -eq "SecurityEvents.ReadWrite.All" }
Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $msportal.Id |
  Where-Object { $_.AppRoleId -eq $role.Id } |
  ForEach-Object { Remove-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $msportal.Id -AppRoleAssignmentId $_.Id }

# Delegated permission: offline_access
Get-MgOauth2PermissionGrant -Filter "clientId eq '$($msportal.Id)'" |
  Where-Object { $_.Scope -split " " -contains "offline_access" } |
  ForEach-Object {
    $scope = ($_.Scope -split " " | Where-Object { $_ -and $_ -ne "offline_access" }) -join " "
    Update-MgOauth2PermissionGrant -OAuth2PermissionGrantId $_.Id -Scope $scope
  }

​

Limit which calendars MSPortal syncs

​

Disconnect a tenant

• New tokens stop immediately. Tokens already issued can stay valid until they expire, typically within about an hour.
• This also stops people in that tenant from signing in to MSPortal with Microsoft.
• Disconnecting in MSPortal alone doesn’t remove consent on the Microsoft side.

​

Related

• Connect companies to Microsoft 365
• Connect rollout companies to Microsoft 365