> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/edges/azure/az_elevate_access.md).

# AZ\_ELEVATE\_ACCESS

## Summary

|                               |                                                                                                |
| ----------------------------- | ---------------------------------------------------------------------------------------------- |
| **Forestall ACL Alias**       | AZ\_ELEVATE\_ACCESS                                                                            |
| **Entra ID (Azure AD) Alias** | Elevate Access                                                                                 |
| **Affected Object Types**     | Tenant Root Management Group (transitively every Management Group, Subscription, and Resource) |
| **Edge Direction**            | Global Administrator principal (User or Group) -> Tenant Root Management Group                 |
| **Exploitation Certainty**    | Certain                                                                                        |
| **Graph Permission / Role**   | Membership in the built-in **Global Administrator** directory role                             |

## Description

`AZ_ELEVATE_ACCESS` represents Microsoft's built-in **Elevate access** capability. A **Global Administrator** can call `POST /providers/Microsoft.Authorization/elevateAccess` to grant themselves the **User Access Administrator** ARM RBAC role at the Azure root scope (`/`).

Global Administrator is a Microsoft Entra ID directory role and, by default, has **no Azure Resource Manager (ARM) permissions**. Elevate access is the bridge between the two planes: after elevating, the Global Administrator holds User Access Administrator at the root of the ARM hierarchy, which inherits down to **every management group, subscription, resource group, and resource** in the tenant through the existing `AZ_PARENT` chain.

The collector draws this edge from each Global Administrator principal to the **Tenant Root Management Group** (whose ARM name equals the tenant id). Service principals and applications are deliberately **not** given this edge, because the `elevateAccess` REST endpoint rejects non-user principals.

This edge turns tenant-level identity compromise into full Azure resource-plane compromise, so it is a critical privilege-escalation and lateral-movement path.

## Identification

### PowerShell (Az / REST)

```powershell
Connect-AzAccount

# Who holds Global Administrator (these principals can elevate access)
$globalAdminRoleDefinitionId = "62e90394-69f5-4237-9190-012177145e10"
$uri = "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments?`$filter=roleDefinitionId eq '$globalAdminRoleDefinitionId'&`$expand=principal"
(Invoke-AzRestMethod -Uri $uri).Content

# Check whether elevate access is currently in effect (root-scope role assignments)
$token = (Get-AzAccessToken -ResourceUrl "https://management.azure.com/").Token
Invoke-RestMethod -Method GET `
  -Uri "https://management.azure.com/providers/Microsoft.Authorization/roleAssignments?api-version=2022-04-01&`$filter=atScope()" `
  -Headers @{ Authorization = "Bearer $token" }
```

### Azure Portal

1. Open **Microsoft Entra admin center** -> **Roles & administrators** -> **Global Administrator** and review the assignments.
2. Open **Azure Portal** -> **Microsoft Entra ID** -> **Manage** -> **Properties**.
3. Review **Access management for Azure resources**. When the toggle is **Yes**, the signed-in Global Administrator currently holds User Access Administrator at root scope.

## Exploitation

### Elevate to User Access Administrator at root scope

```bash
# As a Global Administrator, grant yourself User Access Administrator at "/"
az rest --method post \
  --url "https://management.azure.com/providers/Microsoft.Authorization/elevateAccess?api-version=2016-07-01"
```

After elevation the principal can assign any ARM role (including **Owner**) at any scope:

```bash
# Assign Owner over a subscription to a controlled identity for persistence
az role assignment create --assignee "<ObjectId>" --role "Owner" --scope "/subscriptions/<SubscriptionId>"
```

> **Related Attack Paths:**
>
> * [AZ\_GLOBAL\_ADMIN](https://docs.forestall.io/fsprotect/edges/azure/az_global_admin) - the source role that enables elevate access.
> * [AZ\_USER\_ACCESS\_ADMINISTRATOR](https://docs.forestall.io/fsprotect/edges/azure/az_user_access_administrator) - the ARM role gained at root scope.
> * [AZ\_ASSIGN\_ROLES](https://docs.forestall.io/fsprotect/edges/azure/az_assign_roles) - role-assignment capability the elevated principal obtains.
> * [AZ\_PARENT](https://docs.forestall.io/fsprotect/edges/azure/az_parent) - the containment chain that carries root-scope access down to every subscription and resource.

## Mitigation

* Keep the number of **Global Administrators** as low as possible and prefer eligible (PIM) assignments over permanent ones.
* After any legitimate use of elevate access, **remove the root-scope User Access Administrator assignment** (Azure Portal -> Properties -> set access management for Azure resources back to **No**, or `az role assignment delete` at scope `/`).
* Alert on `Microsoft.Authorization/elevateAccess/action` in the Activity log.
* Use Conditional Access and phishing-resistant MFA for privileged roles.

## Detection

Use the Azure Portal:

1. Open **Azure Portal** -> **Monitor** -> **Activity log** (or the root scope Activity log).
2. Filter **Operation name** for `Assigns the caller to User Access Administrator role` (`Microsoft.Authorization/elevateAccess/action`).
3. Review **Caller**, **Time**, and **Source IP** for unexpected elevation.
4. Filter for `Microsoft.Authorization/roleAssignments/write` at broad scopes (`/`, management group, subscription) that follow an elevation.

## References

* <https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin>
* <https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#global-administrator>
* <https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#user-access-administrator>
* <https://learn.microsoft.com/en-us/azure/role-based-access-control/scope-overview>