AZ_HAS_ROLE

Copy page

Summary


Forestall ACL Alias	AZ_HAS_ROLE
Entra ID (Azure AD) Alias	Directory Role Assignment
Affected Object Types	Users, Groups, Devices, Service Principals -> Directory Role
Edge Direction	Principal -> AZRole
Exploitation Certainty	Informational
Graph Permission / Role	Any Microsoft Entra ID directory role (Global Administrator, Application Administrator, custom directory roles, etc.)

Description

AZ_HAS_ROLE represents a Microsoft Entra ID directory role assignment. This edge connects a principal (User, Group, Device, or Service Principal) to the AZRole node it is assigned, indicating that the principal holds that directory role.

This is the Entra ID (directory-plane) counterpart to AZ_HAS_ARM_ROLE, which represents Azure Resource Manager (ARM) RBAC role assignments. Directory roles govern Microsoft Entra ID and Microsoft 365 workloads; ARM roles govern Azure resources.

The edge carries the assignment metadata as properties:

Property	Meaning
Status	`Active` (permanent assignment), `Eligible` (PIM, activation required), or `Unknown`
AssignmentType	Built-in or custom assignment type
DirectoryScope	`/` for tenant-wide, or `/administrativeUnits/<id>` / `/<objectId>` for a scoped assignment
StartDateTime / EndDateTime	Validity window for time-bound (PIM) assignments
CreatedDateTime	When the assignment was created
PimMetadata	Privileged Identity Management context, when present

This edge is structural. Whether it is dangerous depends on which role is assigned and at what scope; the privileged-role attack edges (for example AZ_GLOBAL_ADMIN, AZ_PRIVILEGED_ROLE_ADMIN) model those outcomes.

Identification

PowerShell (Microsoft Graph)

Connect-MgGraph -Scopes "RoleManagement.Read.Directory","Directory.Read.All"

# All active directory role assignments with principal and role expanded
Get-MgRoleManagementDirectoryRoleAssignment -All -ExpandProperty "principal" |
  ForEach-Object {
    [PSCustomObject]@{
      PrincipalId      = $_.PrincipalId
      RoleDefinitionId = $_.RoleDefinitionId
      DirectoryScopeId = $_.DirectoryScopeId
    }
  } | Format-Table -AutoSize

# Eligible (PIM) assignments
Get-MgRoleManagementDirectoryRoleEligibilitySchedule -All |
  Select-Object PrincipalId, RoleDefinitionId, DirectoryScopeId, Status

Exploitation

There is no direct exploit for this edge; it records that a principal holds a directory role. The impact depends on the role and scope.

Mitigation

Apply least privilege: assign the most specific role at the narrowest scope needed.
Prefer eligible (PIM) assignments over permanent active assignments for privileged roles.
Review directory role assignments regularly with Access Reviews and remove stale ones.
Watch group-based assignments, since a role assigned to a group applies to all members.

Detection

Use the Microsoft Entra admin center:

Open Microsoft Entra ID -> Audit logs.
Filter Activity for Add member to role, Add eligible member to role, and Remove member from role.
Review Initiated by (actor), Target, Date, and Status for uConnect-MgGraph -Scopes “RoleManagement.Read.Directory”,“Directory.Read.All”

All active directory role assignments with principal and role expanded

Get-MgRoleManagementDirectoryRoleAssignment -All -ExpandProperty “principal” | ForEach-Object { [PSCustomObject]@{ PrincipalId = $.PrincipalId RoleDefinitionId = $.RoleDefinitionId DirectoryScopeId = $_.DirectoryScopeId } } | Format-Table -AutoSize

Eligible (PIM) assignments

Get-MgRoleManagementDirectoryRoleEligibilitySchedule -All | Select-Object PrincipalId, RoleDefinitionId, DirectoryScopeId, Statusnexpected role assignment changes. 4. Open Roles & administrators to confirm the current assignment state and scope.

Ask AI