Skip to content
Forestall

AZ_MG_GRANT_APP_ROLES

Copy page

Summary
Forestall ACL Alias AZ_MG_GRANT_APP_ROLES
Entra ID (Azure AD) Alias Grant App Roles (Microsoft Graph)
Affected Object Types Service Principals (Enterprise applications), Users, Groups
Exploitation Certainty Certain
Graph Permission / Role Application Permission: AppRoleAssignment.ReadWrite.All or RoleManagement.ReadWrite.Directory

Description

AZ_MG_GRANT_APP_ROLES represents the ability for a principal to grant app roles via Microsoft Graph by creating app role assignments.

App role assignments can be granted to:

  • A service principal (enterprise application).
  • A user.
  • A group.

By granting an app role to a controlled identity, an attacker can:

  • Assign high-privilege application permissions to a service principal (for example, by assigning Microsoft Graph app roles), then authenticate as that app and act with those privileges.
  • Assign roles in line-of-business applications that gate access to sensitive data or administrative features.
  • Establish persistence by granting roles to long-lived identities (service principals / managed identities).

Therefore, any identity that can grant app roles through Microsoft Graph can quickly escalate privileges or expand access by modifying app role assignments.

Identification

PowerShell (Microsoft Graph)

Enumerate service principals that have Microsoft Graph application permissions that can grant app roles (AppRoleAssignment.ReadWrite.All or RoleManagement.ReadWrite.Directory).

Install-Module Microsoft.Graph -Scope CurrentUser
Import-Module Microsoft.Graph.Applications


Connect-MgGraph -Scopes "Application.Read.All", "AppRoleAssignment.Read.All"


$graphAppId = "00000003-0000-0000-c000-000000000000"
$graphSp = Get-MgServicePrincipal -Filter "appId eq '$graphAppId'"
if (-not $graphSp) { throw "Microsoft Graph service principal not found." }


# Permission IDs that can grant app roles
$targetPermissions = @{
    "AppRoleAssignment.ReadWrite.All"     = "06b708a9-e830-4db3-a914-8e69da51d44f"
    "RoleManagement.ReadWrite.Directory"  = "9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8"
}


# Get all app role assignments granted TO Microsoft Graph
$allAssignments = Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $graphSp.Id -All


# Filter for target permissions
$matchingAssignments = $allAssignments | Where-Object { $targetPermissions.Values -contains $_.AppRoleId }


$results = $matchingAssignments | ForEach-Object {
    $assignment = $_
    $permName = ($targetPermissions.GetEnumerator() | Where-Object { $_.Value -eq $assignment.AppRoleId }).Key
    [PSCustomObject]@{
        ServicePrincipalDisplayName = $assignment.PrincipalDisplayName
        ServicePrincipalId          = $assignment.PrincipalId
        GraphApplicationPermission  = $permName
        AssignedDateTime            = $assignment.CreatedDateTime
    }
}


Write-Host "Found $($results.Count) service principals with permissions that can grant app roles"
$results | Sort-Object GraphApplicationPermission, ServicePrincipalDisplayName | Format-Table -AutoSize

Exploitation

Related Attack Paths:

Azure Portal

  1. Go to Microsoft Entra admin center -> Identity -> Applications -> App registrations.
  2. Open your app registration (Contoso-Automation).
  3. Select API permissions.
  4. Select Add a permission.
  5. Select Microsoft Graph.
  6. Select Application permissions.
  7. Search for Group.Read.All, select it, then choose Add permissions.
  8. Back on API permissions, select Grant admin consent for , then confirm.
  9. Confirm Status shows Granted for Group.Read.All.

Mitigation

  • Remove unnecessary Graph application permissions from service principals:
    • Prioritize removing AppRoleAssignment.ReadWrite.All and RoleManagement.ReadWrite.Directory when not required.
  • Restrict who can grant admin consent and who can manage enterprise applications.
  • Limit privileged directory roles:
    • Keep Application Administrator and Cloud Application Administrator assignments minimal.
    • Use just-in-time access where possible.
  • Implement change control for enterprise app role assignments:
    • Require approvals for role assignment changes on sensitive applications.
  • Regularly review app role assignments:
    • Review both application permissions (app role assignments to Microsoft Graph) and enterprise app roles (Users and groups assignments).

Detection

Use the Microsoft Entra admin center:

  1. Open Microsoft Entra ID -> Audit logs.
  2. Filter for application and enterprise application management activities.
  3. Review activities such as app role assignment added, app role assignment granted, and application role assigned to a user, group, or service principal.
  4. Review Initiated by (actor), Target resources, Date, and Status for unexpected app role grants.
  5. Open the affected Enterprise application and review Permissions, Users and groups, and Owners.

References

Was this page helpful?

Thank you for your feedback.