Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

AZ_GLOBAL_ADMIN

Summary

Forestall ACL Alias

AZ_GLOBAL_ADMIN

Entra ID (Azure AD) Alias

Global Administrator

Affected Object Types

Microsoft Entra tenant (all directory objects and tenant-wide configuration)

Exploitation Certainty

Certain

Graph Permission / Role

Membership in the built-in Global Administrator directory role (direct assignment or via a role-assignable group). If Microsoft Entra PIM is used, eligibility and activations also apply

Description

AZ_GLOBAL_ADMIN represents the ability for a principal to operate as a Global Administrator in Microsoft Entra ID.

A Global Administrator has the highest level of administrative access in the tenant. A Global Administrator can:

  • Assign and remove directory roles.

  • Manage users, groups, devices, and tenant settings.

  • Manage enterprise applications and app registrations, including credentials.

  • Approve permissions and perform tenant-wide application management operations.

  • Change security settings and access control configuration.

Therefore, any identity that holds the Global Administrator role can immediately perform tenant-wide privileged actions and can grant itself or others persistent administrative access.

Identification

PowerShell (Microsoft Graph)

List all members of the Global Administrator role. This includes users, service principals, and groups. If a group is assigned, expand it to identify effective users.

Azure Portal

  • Go to Microsoft Entra admin center -> Roles & administrators.

  • Open Global Administrator.

  • Open Assignments and record:

    • Active assignments

    • Eligible assignments (if PIM is enabled)

  • If a group is assigned:

    • Enumerate its transitive members (nested included).

  • Identify break-glass accounts and confirm they are protected and monitored.

Global Administrator role assignments in Entra admin center

Exploitation

A principal that holds the Global Administrator role can perform tenant-wide privileged actions immediately. This includes granting roles to other identities, changing authentication and access policy, and modifying application permissions and credentials.

Do not treat Global Administrator as an operational role for daily work. Treat it as emergency-only and tightly controlled administrative capability.

Grant Directory Roles

A Global Administrator can assign any directory role to any principal, including granting Global Administrator to a controlled identity for persistence.

For detailed exploitation techniques, see AZ_MG_GRANT_ROLE.

Add Credentials to Applications

A Global Administrator can add client secrets or certificates to any application or service principal, then authenticate as that identity to abuse its permissions.

For detailed exploitation techniques, see AZ_ADD_SECRET.

Add Owners to Applications

A Global Administrator can add owners to applications and service principals, granting persistent control even if the role assignment is later removed.

For detailed exploitation techniques, see AZ_ADD_OWNER.

Modify Group Memberships

A Global Administrator can add principals to any group, including role-assignable groups that grant privileged directory roles.

For detailed exploitation techniques, see AZ_MG_ADD_MEMBER.

Reset User Passwords

A Global Administrator can reset the password of any user in the tenant, including other administrators.

For detailed exploitation techniques, see AZ_RESET_PASSWORD.

Grant Microsoft Graph Permissions

A Global Administrator can grant dangerous Microsoft Graph API permissions to applications, enabling programmatic tenant takeover.

For detailed exploitation techniques, see AZ_MG_GRANT_APP_ROLES.

Mitigation

  • Keep the number of Global Administrators as low as possible.

  • Use Microsoft Entra PIM:

    • Prefer eligible assignments instead of permanent active assignments.

    • Require MFA and approvals for activation where appropriate.

  • Use dedicated admin accounts and enforce strong authentication:

    • Phishing-resistant MFA where possible.

    • Conditional Access policies for privileged roles.

  • Maintain controlled break-glass accounts:

    • Exclude only where necessary, and monitor continuously.

    • Store credentials securely and test access periodically.

  • Review Global Administrator membership regularly and remove stale assignments.

Detection

Use the Microsoft Entra admin center:

  1. Open Microsoft Entra ID -> Audit logs.

  2. Filter Activity for Add member to role, Add eligible member to role, application credential changes, app role assignment changes, Conditional Access changes, and authentication policy changes.

  3. Review Initiated by (actor), Target resources, Date, and Status for unexpected Global Administrator activity.

  4. Open Roles & administrators -> Global Administrator -> Assignments to review current assignments and recent activations.

  5. Use Manage view -> Edit columns if any of those fields are hidden.

References

PreviousAZ_GET_SECRETS
NextAZ_GROUP_WRITEBACK

Last updated

Was this helpful?