Keeping a Short Leash: New AzureHound Least-Privilege Documentation

This SpecterOps research post documents a validated least-privilege permission set for AzureHound by inventorying MS Graph and ARM API calls, mapping them to the narrowest application and RBAC permissions, empirically testing endpoint access and data completeness (permission matrix and full-collection comparisons), and producing updated documentation, scripts, and a custom AzureHound Reader role; the output is defensive guidance to reduce standing access rather than an incident report.