Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Dynamic groups are groups that has a set of rules configured and all the users or devices that match the rules are added to the group. Every time a user or device attribute is changed, dynamic rules are rechecked. And when a new rule is created all devices and users are checked.
Dynamic groups can have Azure RBAC roles assigned to them, but it's not possible to add AzureAD roles to dynamic groups.
This feature requires Azure AD premium P1 license.
Note that by default any user can invite guests in Azure AD, so, If a dynamic group rule gives permissions to users based on attributes that can be set in a new guest, it's possible to create a guest with this attributes and escalate privileges. It's also possible for a guest to manage his own profile and change these attributes.
Get groups that allow Dynamic membership: az ad group list --query "[?contains(groupTypes, 'DynamicMembership')]" --output table
Rule example: (user.otherMails -any (_ -contains "security")) -and (user.userType -eq "guest")
Rule description: Any Guest user with a secondary email with the string 'security' will be added to the group
For the Guest user email, accept the invitation and check the current settings of that user in https://entra.microsoft.com/#view/Microsoft_AAD_IAM/TenantOverview.ReactView. Unfortunately the page doesn't allow to modify the attribute values so we need to use the API:
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
