Skip to content
Forestall

AZ_MG_DANGEROUS_PERMISSION

Copy page

Summary
Forestall ACL Alias AZ_MG_DANGEROUS_PERMISSION
Entra ID (Azure AD) Alias High-Risk Microsoft Graph Permissions
Affected Object Types Service Principals, Applications
Exploitation Certainty Certain
Graph Permission / Role Various high-risk application permissions

Description

AZ_MG_DANGEROUS_PERMISSION represents Microsoft Graph application permissions that can be abused for privilege escalation, persistence, or data exfiltration.

Tier 0 - Direct (Immediate Privilege Escalation):

Permission GUID
RoleManagement.ReadWrite.Directory 9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8
RoleAssignmentSchedule.ReadWrite.Directory dd199f4a-f148-40a4-a2ec-f0069cc799ec
Policy.ReadWrite.ConditionalAccess 01c0a623-fc9b-48e9-b794-0756f8e8f067
DelegatedAdminRelationship.ReadWrite.All cc13eba4-8cd8-44c6-b4d4-f93237adce58
PrivilegedAccess.ReadWrite.AzureADGroup 2f6817f8-7b12-4f0f-bc18-eeaf60705a9e
PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup 41202f2c-f7ab-45be-b001-85c9728b9d69
UserAuthenticationMethod.ReadWrite.All 50483e42-d915-4231-9639-7fdb7fd190e5
User.DeleteRestore.All eccc023d-eccf-4e7b-9683-8813ab36cecc
User.EnableDisableAccount.All 3011c876-62b7-4ada-afa2-506cbbecc68c

Tier 0 - Indirect (Requires Additional Steps):

Permission GUID
AppRoleAssignment.ReadWrite.All 06b708a9-e830-4db3-a914-8e69da51d44f
Application.ReadWrite.All 1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9
Application.ReadWrite.OwnedBy 18a4783c-866b-4cc7-a460-3d5e5662c884
Directory.ReadWrite.All 19dbc75e-c2e2-444c-a770-ec69d8559fc7
Group.ReadWrite.All 62a82d76-70ea-41e2-9197-370581804d09
GroupMember.ReadWrite.All dbaae8cf-10b5-4b86-a4a1-f871c94c6695
User.ReadWrite.All 741f803b-c850-494e-b5df-cde7c675a1ca
User-PasswordProfile.ReadWrite.All cc117bb9-00cf-4eb8-b580-ea2a878fe8f7
Domain.ReadWrite.All 7e05723c-0bb0-42da-be95-ae9f08a6e53c
Organization.ReadWrite.All 292d869f-3427-49a8-9dab-8c70152b74e9
AdministrativeUnit.ReadWrite.All 5eb59dd3-1da2-4329-8733-9dabdc435916
EntitlementManagement.ReadWrite.All 9acd699f-1e81-4958-b001-93b1d2506e19
Synchronization.ReadWrite.All 9b50c33d-700f-43b1-b2eb-87e89b703581
Policy.ReadWrite.AuthenticationMethod 29c18626-4985-4dcd-85c0-193eef327366
Policy.ReadWrite.PermissionGrant a402ca1c-2696-4531-972d-6e5ee4aa11ea
PrivilegedAccess.ReadWrite.AzureAD 854d9ab1-6657-4ec8-be45-823027bcd009
PrivilegedAccess.ReadWrite.AzureResources 6f9d5abc-2db6-400b-a267-7de22a40fb87
PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup 618b6020-bca8-4de6-99f6-ef445fa4d857
RoleEligibilitySchedule.ReadWrite.Directory fee28b28-e1f3-4841-818e-2704dc62245f
RoleManagementPolicy.ReadWrite.AzureADGroup b38dcc4d-a239-4ed6-aa84-6c65b284f97c
RoleManagementPolicy.ReadWrite.Directory 31e08e0a-d3f7-4ca2-ac39-7343fb83e8ad
SecurityIdentitiesActions.ReadWrite.All af2bf46f-7bf1-4be3-8bad-e17e279e8462
SignInIdentifier.ReadWrite.All 7fc588a2-ea2d-4d1f-bcf7-33c324b149b8
DeviceManagementConfiguration.ReadWrite.All 9241abd9-d0e6-425a-bd4f-47ba86e767a4
DeviceManagementRBAC.ReadWrite.All e330c4f0-4170-414e-a55a-2f022ec2b57b
DeviceManagementScripts.ReadWrite.All 9255e99d-faf5-445e-bbf7-cb71482737c4
Group-OnPremisesSyncBehavior.ReadWrite.All 2d9bd318-b883-40be-9df7-63ec4fcdc424

Identification

PowerShell (Microsoft Graph)

Find Service Principals with Dangerous Permissions:

Connect-MgGraph -Scopes "Application.Read.All"


# Tier 0 Direct - Immediate privilege escalation
$tier0Direct = @{
    "cc13eba4-8cd8-44c6-b4d4-f93237adce58" = "DelegatedAdminRelationship.ReadWrite.All"
    "01c0a623-fc9b-48e9-b794-0756f8e8f067" = "Policy.ReadWrite.ConditionalAccess"
    "2f6817f8-7b12-4f0f-bc18-eeaf60705a9e" = "PrivilegedAccess.ReadWrite.AzureADGroup"
    "41202f2c-f7ab-45be-b001-85c9728b9d69" = "PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup"
    "dd199f4a-f148-40a4-a2ec-f0069cc799ec" = "RoleAssignmentSchedule.ReadWrite.Directory"
    "9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8" = "RoleManagement.ReadWrite.Directory"
    "eccc023d-eccf-4e7b-9683-8813ab36cecc" = "User.DeleteRestore.All"
    "3011c876-62b7-4ada-afa2-506cbbecc68c" = "User.EnableDisableAccount.All"
    "50483e42-d915-4231-9639-7fdb7fd190e5" = "UserAuthenticationMethod.ReadWrite.All"
}


# Tier 0 Indirect - Requires additional steps
$tier0Indirect = @{
    "5eb59dd3-1da2-4329-8733-9dabdc435916" = "AdministrativeUnit.ReadWrite.All"
    "1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9" = "Application.ReadWrite.All"
    "18a4783c-866b-4cc7-a460-3d5e5662c884" = "Application.ReadWrite.OwnedBy"
    "06b708a9-e830-4db3-a914-8e69da51d44f" = "AppRoleAssignment.ReadWrite.All"
    "9241abd9-d0e6-425a-bd4f-47ba86e767a4" = "DeviceManagementConfiguration.ReadWrite.All"
    "e330c4f0-4170-414e-a55a-2f022ec2b57b" = "DeviceManagementRBAC.ReadWrite.All"
    "9255e99d-faf5-445e-bbf7-cb71482737c4" = "DeviceManagementScripts.ReadWrite.All"
    "19dbc75e-c2e2-444c-a770-ec69d8559fc7" = "Directory.ReadWrite.All"
    "7e05723c-0bb0-42da-be95-ae9f08a6e53c" = "Domain.ReadWrite.All"
    "9acd699f-1e81-4958-b001-93b1d2506e19" = "EntitlementManagement.ReadWrite.All"
    "62a82d76-70ea-41e2-9197-370581804d09" = "Group.ReadWrite.All"
    "dbaae8cf-10b5-4b86-a4a1-f871c94c6695" = "GroupMember.ReadWrite.All"
    "292d869f-3427-49a8-9dab-8c70152b74e9" = "Organization.ReadWrite.All"
    "29c18626-4985-4dcd-85c0-193eef327366" = "Policy.ReadWrite.AuthenticationMethod"
    "a402ca1c-2696-4531-972d-6e5ee4aa11ea" = "Policy.ReadWrite.PermissionGrant"
    "854d9ab1-6657-4ec8-be45-823027bcd009" = "PrivilegedAccess.ReadWrite.AzureAD"
    "6f9d5abc-2db6-400b-a267-7de22a40fb87" = "PrivilegedAccess.ReadWrite.AzureResources"
    "618b6020-bca8-4de6-99f6-ef445fa4d857" = "PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup"
    "fee28b28-e1f3-4841-818e-2704dc62245f" = "RoleEligibilitySchedule.ReadWrite.Directory"
    "b38dcc4d-a239-4ed6-aa84-6c65b284f97c" = "RoleManagementPolicy.ReadWrite.AzureADGroup"
    "31e08e0a-d3f7-4ca2-ac39-7343fb83e8ad" = "RoleManagementPolicy.ReadWrite.Directory"
    "af2bf46f-7bf1-4be3-8bad-e17e279e8462" = "SecurityIdentitiesActions.ReadWrite.All"
    "7fc588a2-ea2d-4d1f-bcf7-33c324b149b8" = "SignInIdentifier.ReadWrite.All"
    "9b50c33d-700f-43b1-b2eb-87e89b703581" = "Synchronization.ReadWrite.All"
    "741f803b-c850-494e-b5df-cde7c675a1ca" = "User.ReadWrite.All"
    "cc117bb9-00cf-4eb8-b580-ea2a878fe8f7" = "User-PasswordProfile.ReadWrite.All"
    "2d9bd318-b883-40be-9df7-63ec4fcdc424" = "Group-OnPremisesSyncBehavior.ReadWrite.All"
}


$allDangerous = $tier0Direct + $tier0Indirect
$graphSp = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"


Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $graphSp.Id -All | Where-Object {
    $allDangerous.ContainsKey($_.AppRoleId.ToString())
} | ForEach-Object {
    $sp = Get-MgServicePrincipal -ServicePrincipalId $_.PrincipalId
    $permId = $_.AppRoleId.ToString()
    $tier = if ($tier0Direct.ContainsKey($permId)) { "Direct" } else { "Indirect" }
    [PSCustomObject]@{
        DisplayName = $sp.DisplayName
        AppId       = $sp.AppId
        Permission  = $allDangerous[$permId]
        Tier        = $tier
    }
} | Sort-Object Tier, Permission | Format-Table -AutoSize

Exploitation

Exploitation depends on which dangerous permission the service principal has. See the specific edge documentation:

Tier 0 Direct:

Tier 0 Indirect:

Mitigation

  • Audit and remove unnecessary dangerous permissions from service principals
  • Apply least privilege: Use read-only permissions where possible
  • Prioritize Tier 0 Direct: Remove or closely monitor these permissions first
  • Regular access reviews for applications with dangerous permissions
  • Alert on new grants of dangerous permissions

Detection

Use the Microsoft Entra admin center:

  1. Open Microsoft Entra ID -> Audit logs.
  2. Filter Activity for Add app role assignment to service principal.
  3. Review Initiated by (actor), Target, Date, and Status for unexpected dangerous permission grants.
  4. Use Manage view -> Edit columns if any of those fields are hidden.

References

Was this page helpful?

Thank you for your feedback.