> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/edges/azure/az_has_role.md).

# AZ\_HAS\_ROLE

## AZ\_HAS\_ROLE

### Summary

|                               |                                                                                                                       |
| ----------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| **Forestall ACL Alias**       | AZ\_HAS\_ROLE                                                                                                         |
| **Entra ID (Azure AD) Alias** | Directory Role Assignment                                                                                             |
| **Affected Object Types**     | Users, Groups, Devices, Service Principals -> Directory Role                                                          |
| **Edge Direction**            | Principal -> AZRole                                                                                                   |
| **Exploitation Certainty**    | Informational                                                                                                         |
| **Graph Permission / Role**   | Any Microsoft Entra ID directory role (Global Administrator, Application Administrator, custom directory roles, etc.) |

### Description

`AZ_HAS_ROLE` represents a **Microsoft Entra ID directory role assignment**. This edge connects a principal (User, Group, Device, or Service Principal) to the `AZRole` node it is assigned, indicating that the principal holds that directory role.

This is the Entra ID (directory-plane) counterpart to [AZ\_HAS\_ARM\_ROLE](https://docs.forestall.io/fsprotect/edges/azure/az_has_arm_role), which represents Azure Resource Manager (ARM) RBAC role assignments. Directory roles govern Microsoft Entra ID and Microsoft 365 workloads; ARM roles govern Azure resources.

The edge carries the assignment metadata as properties:

| Property                        | Meaning                                                                                     |
| ------------------------------- | ------------------------------------------------------------------------------------------- |
| **Status**                      | `Active` (permanent assignment), `Eligible` (PIM, activation required), or `Unknown`        |
| **AssignmentType**              | Built-in or custom assignment type                                                          |
| **DirectoryScope**              | `/` for tenant-wide, or `/administrativeUnits/<id>` / `/<objectId>` for a scoped assignment |
| **StartDateTime / EndDateTime** | Validity window for time-bound (PIM) assignments                                            |
| **CreatedDateTime**             | When the assignment was created                                                             |
| **PimMetadata**                 | Privileged Identity Management context, when present                                        |

This edge is structural. Whether it is dangerous depends on **which role** is assigned and **at what scope**; the privileged-role attack edges (for example [AZ\_GLOBAL\_ADMIN](https://docs.forestall.io/fsprotect/edges/azure/az_global_admin), [AZ\_PRIVILEGED\_ROLE\_ADMIN](https://docs.forestall.io/fsprotect/edges/azure/az_privileged_role_admin)) model those outcomes.

### Identification

#### PowerShell (Microsoft Graph)

```powershell
Connect-MgGraph -Scopes "RoleManagement.Read.Directory","Directory.Read.All"

# All active directory role assignments with principal and role expanded
Get-MgRoleManagementDirectoryRoleAssignment -All -ExpandProperty "principal" |
  ForEach-Object {
    [PSCustomObject]@{
      PrincipalId      = $_.PrincipalId
      RoleDefinitionId = $_.RoleDefinitionId
      DirectoryScopeId = $_.DirectoryScopeId
    }
  } | Format-Table -AutoSize

# Eligible (PIM) assignments
Get-MgRoleManagementDirectoryRoleEligibilitySchedule -All |
  Select-Object PrincipalId, RoleDefinitionId, DirectoryScopeId, Status
```

#### Azure Portal

1. Open **Microsoft Entra admin center** -> **Roles & administrators**.
2. Select a role and open **Assignments** to see the principals that hold it.
3. Use **Privileged Identity Management** to view eligible versus active assignments and their scope.

### Exploitation

There is no direct exploit for this edge; it records that a principal holds a directory role. The impact depends on the role and scope.

### Mitigation

* Apply least privilege: assign the most specific role at the narrowest scope needed.
* Prefer eligible (PIM) assignments over permanent active assignments for privileged roles.
* Review directory role assignments regularly with Access Reviews and remove stale ones.
* Watch group-based assignments, since a role assigned to a group applies to all members.

### Detection

Use the Microsoft Entra admin center:

1. Open **Microsoft Entra ID** -> **Audit logs**.
2. Filter **Activity** for **Add member to role**, **Add eligible member to role**, and **Remove member from role**.
3. Review **Initiated by (actor)**, **Target**, **Date**, and **Status** for uConnect-MgGraph -Scopes "RoleManagement.Read.Directory","Directory.Read.All"

## All active directory role assignments with principal and role expanded

Get-MgRoleManagementDirectoryRoleAssignment -All -ExpandProperty "principal" | ForEach-Object { \[PSCustomObject]@{ PrincipalId = $*.PrincipalId RoleDefinitionId = $*.RoleDefinitionId DirectoryScopeId = $\_.DirectoryScopeId } } | Format-Table -AutoSize

## Eligible (PIM) assignments

Get-MgRoleManagementDirectoryRoleEligibilitySchedule -All | Select-Object PrincipalId, RoleDefinitionId, DirectoryScopeId, Statusnexpected role assignment changes. 4. Open **Roles & administrators** to confirm the current assignment state and scope.

### References

* <https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference>
* <https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/custom-assign-graph>
* <https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure>
* <https://learn.microsoft.com/en-us/graph/api/resources/unifiedroleassignment>