Skip to content
Forestall

AZ_IN_GROUP

Copy page

Summary
Forestall ACL Alias AZ_IN_GROUP
Entra ID (Azure AD) Alias Group Member
Affected Object Types Users, Service Principals, Groups
Exploitation Certainty Certain

Description

AZ_IN_GROUP represents that a principal (user, service principal, or another group) is a member of a Microsoft Entra (Azure AD) group. Group membership in Entra ID is fundamental to identity management and access control, as groups are used to assign:

  • Azure RBAC permissions on subscriptions, resource groups, and resources.
  • Directory roles when the group is role-assignable (isAssignableToRole = true).
  • Application access through Conditional Access policies and app assignments.
  • License assignments for Microsoft 365 and other services.

By being a member of a group, a principal inherits all the permissions and privileges assigned to that group. This transitive relationship means that if an attacker compromises an account that is a member of a privileged group, they gain access to all resources and capabilities granted to that group.

Identification

PowerShell

Connect-MgGraph -Scopes "Group.Read.All","GroupMember.Read.All"


# Get all groups and their members
$groups = Get-MgGroup -All
$results = foreach ($group in $groups) {
    $members = Get-MgGroupMember -GroupId $group.Id -All
    foreach ($member in $members) {
        [PSCustomObject]@{
            GroupName  = $group.DisplayName
            GroupId    = $group.Id
            MemberName = $member.AdditionalProperties.displayName
            MemberType = ($member.AdditionalProperties.'@odata.type' -replace '#microsoft.graph.', '')
            MemberId   = $member.Id
        }
    }
}
$results | Export-Csv -Path ".\AzureGroupMembers.csv" -NoTypeInformation -Encoding UTF8

To check membership for a specific user:

Connect-MgGraph -Scopes "User.Read.All","GroupMember.Read.All"


$userUPN = "[email protected]"
$user = Get-MgUser -UserId $userUPN


# Get groups the user is a member of
$userGroups = Get-MgUserMemberOf -UserId $user.Id -All | Where-Object {
    $_.AdditionalProperties.'@odata.type' -eq '#microsoft.graph.group'
}


$userGroups | ForEach-Object {
    [PSCustomObject]@{
        DisplayName = $_.AdditionalProperties.displayName
        Id          = $_.Id
    }
} | Format-Table -AutoSize

To enumerate transitive group memberships (including nested groups):

Connect-MgGraph -Scopes "User.Read.All","GroupMember.Read.All"


$userUPN = "[email protected]"
$user = Get-MgUser -UserId $userUPN


# Get transitive group memberships (includes nested groups)
$transitiveGroups = Get-MgUserTransitiveMemberOf -UserId $user.Id -All | Where-Object {
    $_.AdditionalProperties.'@odata.type' -eq '#microsoft.graph.group'
}


$transitiveGroups | ForEach-Object {
    [PSCustomObject]@{
        GroupName = $_.AdditionalProperties.displayName
        GroupId   = $_.Id
    }
} | Format-Table -AutoSize

Exploitation

There is no direct exploit path for this edge. AZ_IN_GROUP indicates that a principal is a member of a group, representing a relationship rather than an exploitable permission. The privileges inherited through group membership depend on what permissions are assigned to that group (Azure RBAC roles, directory roles, application access, etc.).

Mitigation

No specific mitigation is required for this edge, as it represents a membership relationship. However, organizations should regularly audit group memberships to ensure only authorized principals are members of sensitive groups.

Detection

Use the Microsoft Entra admin center:

  1. Open Microsoft Entra ID -> Audit logs.
  2. Click Category: All -> select GroupManagement -> Apply.
  3. Filter or review Activity for:
    • Add member to group
    • Remove member from group
  4. Review Initiated by (actor), Target, Date, and Status for unexpected group membership changes.
  5. Open the affected group and review the Members blade.
Group management audit logs in Entra ID

Group management audit logs in Entra ID

References

Was this page helpful?

Thank you for your feedback.