AZ_MG_GROUP_READWRITE_ALL

Copy page

Summary


Forestall ACL Alias	AZ_MG_GROUP_READWRITE_ALL
Entra ID (Azure AD) Alias	Group.ReadWrite.All
Affected Object Types	Service Principals, Applications
Exploitation Certainty	Certain
Graph Permission / Role	Application Permission: Group.ReadWrite.All

Description

AZ_MG_GROUP_READWRITE_ALL grants full read and write access to all groups in Microsoft Entra ID.

Capabilities:

Create, update, delete groups (security groups and Microsoft 365 groups)
Add/remove members from any group
Add/remove owners from any group
Manage dynamic membership rules

Limitations:

Cannot modify role-assignable groups (requires RoleManagement.ReadWrite.Directory)

Abuse scenarios:

Persistence: Create backdoor groups with elevated permissions
Lateral movement: Add accounts to groups with Azure RBAC or application access
Defense evasion: Remove security team members from monitoring groups

Identification

PowerShell (Microsoft Graph)

Connect-MgGraph -Scopes "Application.Read.All"

$permissionId = "62a82d76-70ea-41e2-9197-370581804d09"  # Group.ReadWrite.All
$graphSp = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"

Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $graphSp.Id -All | Where-Object { $_.AppRoleId -eq $permissionId } | ForEach-Object {
    $sp = Get-MgServicePrincipal -ServicePrincipalId $_.PrincipalId
    [PSCustomObject]@{ DisplayName = $sp.DisplayName; AppId = $sp.AppId }
} | Format-Table -AutoSize

Exploitation

An attacker with Group.ReadWrite.All can add accounts to normal security groups and create backdoor groups.

For adding members to groups, see AZ_MG_ADD_MEMBER.

Mitigation

Audit and remove unnecessary Group.ReadWrite.All grants
Apply least privilege:
- Use Group.Read.All if only read access is needed
- Use GroupMember.ReadWrite.All if only membership management is needed
Regular access reviews for applications with this permission

Detection

Use the Microsoft Entra admin center:

Open Microsoft Entra ID -> Audit logs.
Filter Activity for Add group, Delete group, and Add member to group.
Review Initiated by (actor), Target, Date, and Status for unexpected group changes.
Use Manage view -> Edit columns if any of those fields are hidden.

Ask AI