AuthenticationToken

[SebastiaanTheunissen]

Hi,

I am running into an authentication token lifetime issue when running this against a Tenant with > 300000 groups

I am using a service principal to run the execution.

Is there a way I can exclude groups from a scan or increase the token lifetime somehow?

[zh54321]

Hi @SebastiaanTheunissen

Thank you for reporting this. With around 340'000 groups, this is indeed a very large tenant.

I can see the likely cause, especially when using a service principal (less token life-time than a user with a CAE token). EntraFalcon already performs several token-lifetime checks and refreshes tokens when necessary. However, these checks currently occur between collection phases, not within long-running Microsoft Graph batch-request loops. I am working on adding token checks and refreshes within these loops and aim to have a fix available within the next one to two weeks. I will provide an update here once it is ready.

Skipping group collection is currently not supported, as it would significantly reduce the assessment’s coverage. EntraFalcon uses the collected group data across all other reports to identify inherited access and privileges.

A few notes regarding tenants of this size:

• Use PowerShell 7 if possible. It generally provides somewhat better performance and produces more compact JSON, which should help with a tenant of this size.
• I am unsure how well an HTML report containing 340'000 group objects will perform. Consider using -LimitResults 30000 to include only the 30'000 groups with the highest impact scores in the report. Note that this limits only the report output, not the underlying data collection.
• To be fully transparent, even after the token-refresh issue is fixed, assessing a tenant of this size may remain challenging due to the large number of API requests, high memory usage, and potentially very large report files.

[SebastiaanTheunissen]

Thanks for your quick answer. Completely understand the pain points of having such a large environment.
Looking forward to the fix and see if that will improve our results.

btw I have got another question/future request do you want me to raise that into a separate issue?

[zh54321]

A seperate issue would be nice.