Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Note that not all the granular permissions built-in roles have in Entra ID are elegible to be used in custom roles.
This role contains the necessary granular permissions to be able to assign roles to principals and to give more permissions to roles. Both actions could be abused to escalate privileges.
Assign role to a user:
Add more permissions to a role:
microsoft.directory/applications/credentials/updateThis allows an attacker to add credentials (passwords or certificates) to existing applications. If the application has privileged permissions, the attacker can authenticate as that application and gain those privileges.
microsoft.directory/applications.myOrganization/credentials/updateThis allows the same actions as applications/credentials/update, but scoped to single-directory applications.
microsoft.directory/applications/owners/updateBy adding themselves as an owner, an attacker can manipulate the application, including credentials and permissions.
microsoft.directory/applications/allProperties/updateAn attacker can add a redirect URI to applications that are being used by users of the tenant and then share with them login URLs that use the new redirect URL in order to steal their tokens. Note that if the user was already logged in the application, the authentication is going to be automatic without the user needing to accept anything.
Note that it's also possible to change the permissions the application requests in order to get more permissions, but in this case the user will need accept again the prompt asking for all the permissions.
microsoft.directory/servicePrincipals/credentials/updateThis allows an attacker to add credentials to existing service principals. If the service principal has elevated privileges, the attacker can assume those privileges.
The new generated password won't appear in the web console, so this could be a stealth way to maintain persistence over a service principal.
From the API they can be found with: az ad sp list --query '[?length(keyCredentials) > 0 || length(passwordCredentials) > 0].[displayName, appId, keyCredentials, passwordCredentials]' -o json
If you get the error "code":"CannotUpdateLockedServicePrincipalProperty","message":"Property passwordCredentials is invalid." it's because it's not possible to modify the passwordCredentials property of the SP and first you need to unlock it. For it you need a permission (microsoft.directory/applications/allProperties/update) that allows you to execute:
microsoft.directory/servicePrincipals/synchronizationCredentials/manageThis allows an attacker to add credentials to existing service principals. If the service principal has elevated privileges, the attacker can assume those privileges.
microsoft.directory/servicePrincipals/owners/updateSimilar to applications, this permission allows to add more owners to a service principal. Owning a service principal allows control over its credentials and permissions.
After adding a new owner, I tried to remove it but the API responded that the DELETE method wasn't supported, even if it's the method you need to use to delete the owner. So you can't remove owners nowadays.
microsoft.directory/servicePrincipals/disable and enableThese permissions allows to disable and enable service principals. An attacker could use this permission to enable a service principal he could get access to somehow to escalate privileges.
Note that for this technique the attacker will need more permissions in order to take over the enabled service principal.
microsoft.directory/servicePrincipals/getPasswordSingleSignOnCredentials & microsoft.directory/servicePrincipals/managePasswordSingleSignOnCredentialsThese permissions allow to create and get credentials for single sign-on which could allow access to third-party applications.
microsoft.directory/groups/allProperties/updateThis permission allows to add users to privileged groups, leading to privilege escalation.
Note: This permission excludes Entra ID role-assignable groups.
microsoft.directory/groups/owners/updateThis permission allows to become an owner of groups. An owner of a group can control group membership and settings, potentially escalating privileges to the group.
Note: This permission excludes Entra ID role-assignable groups.
microsoft.directory/groups/members/updateThis permission allows to add members to a group. An attacker could add himself or malicious accounts to privileged groups can grant elevated access.
microsoft.directory/groups/dynamicMembershipRule/updateThis permission allows to update membership rule in a dynamic group. An attacker could modify dynamic rules to include himself in privileged groups without explicit addition.
Note: This permission excludes Entra ID role-assignable groups.
It might be possible for users to escalate privileges modifying their own properties to be added as members of dynamic groups. For more info check:
Az - Dynamic Groups Privescmicrosoft.directory/users/password/updateThis permission allows to reset password to non-admin users, allowing a potential attacker to escalate privileges to other users. This permission cannot be assigned to custom roles.
microsoft.directory/users/basic/updateThis privilege allows to modify properties of the user. It's common to find dynamic groups that add users based on properties values, therefore, this permission could allow a user to set the needed property value to be a member to a specific dynamic group and escalate privileges.
Misconfigured conditional access policies requiring MFA could be bypassed, check:
Az - Conditional Access Policies & MFA Bypassmicrosoft.directory/devices/registeredOwners/updateThis permission allows attackers to assigning themselves as owners of devices to gain control or access to device-specific settings and data.
microsoft.directory/devices/registeredUsers/updateThis permission allows attackers to associate their account with devices to gain access or to bypass security policies.
microsoft.directory/deviceLocalCredentials/password/readThis permission allows attackers to read the properties of the backed up local administrator account credentials for Microsoft Entra joined devices, including the password
microsoft.directory/bitlockerKeys/key/readThis permission allows to access BitLocker keys, which could allow an attacker to decrypt drives, compromising data confidentiality.
microsoft.directory/applications/permissions/update
microsoft.directory/servicePrincipals/permissions/update
microsoft.directory/applications.myOrganization/allProperties/update
microsoft.directory/applications/allProperties/update
microsoft.directory/servicePrincipals/appRoleAssignedTo/update
microsoft.directory/applications/appRoles/update
microsoft.directory/applications.myOrganization/permissions/update
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
