What are the Risks of using app with dangerous delegated permissions in azure?

Question

What are the risks in using an app with dangerous delegated permissions - besides luring a privileged user to connect the app and use his privileges?

Are there any known dangerous delegated permissions that a low privileged user (attacker) can use?

Answer 1

Note that: The normal user will not be having privileges to perform action on the tenant.

A normal user cannot create resources, cannot access mails of all users, cannot update user profiles, cannot access the user's OneDrive files, cannot send mail on behalf of the user, Performing Operations on Azure AD, Reading and Writing Data, Managing Resources but if the app has delegated permissions, then the user will be able to do it.

For example, the normal user will not be having privileges to update the user profiles.

But if the application has User.ReadWrite.All API permission, and the user authenticates with the application then the user will be able to successfully update the user profile.

The user will be able to update other user profiles:

PATCH https://graph.microsoft.com/v1.0/users/{id}
Content-type: application/json

{
  "businessPhones": [
    "xxx"
  ],
  "officeLocation": "xxx"
}