AZ_CLOUD_APP_ADMIN

Summary

Forestall ACL Alias	AZ_CLOUD_APP_ADMIN
Entra ID (Azure AD) Alias	Cloud Application Administrator
Affected Object Types	App registrations (Applications) & Enterprise applications (Service Principals)
Exploitation Certainty	Certain
Graph Permission / Role	Membership in the Cloud Application Administrator directory role (direct assignment or via a role-assignable group). This role can manage enterprise apps and app registrations. It has the same permissions as Application Administrator, except it cannot manage Application Proxy.

Description

AZ_CLOUD_APP_ADMIN represents the ability for a principal to operate as a Cloud Application Administrator in Microsoft Entra ID.

A Cloud Application Administrator can create and manage applications in the tenant. This includes app registrations and enterprise applications. This role can manage application configuration and assignments.

By controlling application objects, an attacker can:

• Add credentials (client secrets or certificates) to applications and service principals and impersonate them.

• Modify application configuration that impacts authentication and access.

• Grant consent to permissions (within role limits) and expand what an application can do.

• Assign owners or change access paths to establish persistence.

Therefore, any identity that holds the Cloud Application Administrator role can escalate privileges by taking control of application identities and their permissions.

Identification

PowerShell (Microsoft Graph)

List all members of the Cloud Application Administrator role. If a group is assigned, expand it to identify effective users.

Connect-MgGraph -Scopes "RoleManagement.Read.Directory","Directory.Read.All"

$roleDefinitionId = "158c047a-c907-4556-b7ef-446551a6b5f7"
$uri = "/v1.0/roleManagement/directory/roleAssignments?`$filter=roleDefinitionId eq '$roleDefinitionId'&`$expand=principal"

$r = Invoke-MgGraphRequest -Method GET -Uri $uri

$r.value | ForEach-Object {
  $p = $_.principal
  [PSCustomObject]@{
    PrincipalType     = $p.'@odata.type'
    DisplayName       = $p.displayName
    UserPrincipalName = $p.userPrincipalName
    AppId             = $p.appId
    ObjectId          = $_.principalId
    DirectoryScopeId  = $_.directoryScopeId
  }
} | Format-Table -AutoSize

Azure CLI (read-only via Microsoft Graph)

# Find the Cloud Application Administrator directory role
az rest --method GET --url "https://graph.microsoft.com/v1.0/directoryRoles" --query "value[?displayName=='Cloud Application Administrator']"

# List members of the role (replace {role-id})
az rest --method GET --url "https://graph.microsoft.com/v1.0/directoryRoles/{role-id}/members"

Azure Portal

1. Open Microsoft Entra admin center -> Roles & administrators.

2. Search and open Cloud Application Administrator.

3. Open Assignments and record:

   • Active assignments

   • Eligible assignments (if PIM is enabled)

4. If a group is assigned:

   • Enumerate its transitive members (nested included).

5. Identify which assignments are operationally required and which are legacy or unused.

Cloud Application Administrator role assignments in Entra admin center

Exploitation

A Cloud Application Administrator can take control of application identities. This can be used to gain persistence and expand access.

Common high-impact actions include:

• Adding new credentials (client secrets or certificates) to an application or service principal.

• Modifying application configuration (reply URLs, certificates, claims, sign-in settings, and access assignments).

• Granting consent to permissions (within role limits).

• Assigning or changing owners on application objects.

Treat Cloud Application Administrator as a privileged role. Do not assign it broadly.

Add Secret to Application

For detailed exploitation techniques on adding secrets to applications and service principals, see AZ_ADD_SECRET.

Add Owner to Application

For detailed exploitation techniques on adding owners to applications, see AZ_ADD_OWNER.

Mitigation

• Keep Cloud Application Administrator assignments minimal.

• Use PIM:

  • Prefer eligible assignments.

  • Require MFA and approvals for activation where appropriate.

• Prefer custom roles with scoped application permissions where possible.

• Minimize application owners and restrict who can manage credentials for sensitive apps.

• Restrict who can grant admin consent and who can manage enterprise applications.

• Review application credentials and permissions regularly for high-value apps.

Detection

Use the Microsoft Entra admin center:

1. Open Microsoft Entra ID -> Audit logs.

2. Filter Activity for Add member to role, Add eligible member to role, certificates and secrets management changes, consent changes, and app role assignment changes.

3. Review Initiated by (actor), Target resources, Date, and Status for unexpected Cloud Application Administrator assignments or application changes.

4. Open Roles & administrators -> Cloud Application Administrator -> Assignments to review current assignments and recent activations.

5. Use Manage view -> Edit columns if any of those fields are hidden.

Application certificates and secrets management audit logs

References

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-app-roles

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference

https://learn.microsoft.com/en-us/graph/api/directoryrole-list-members?view=graph-rest-1.0

https://learn.microsoft.com/en-us/graph/api/directoryrole-list?view=graph-rest-1.0

https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities

https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-audit-logs