AZ_MG_GROUP_READWRITE_ALL

Summary

Forestall ACL Alias	AZ_MG_GROUP_READWRITE_ALL
Entra ID (Azure AD) Alias	Group.ReadWrite.All
Affected Object Types	Service Principals, Applications
Exploitation Certainty	Certain
Graph Permission / Role	Application Permission: Group.ReadWrite.All

Description

AZ_MG_GROUP_READWRITE_ALL grants full read and write access to all groups in Microsoft Entra ID.

Capabilities:

• Create, update, delete groups (security groups and Microsoft 365 groups)

• Add/remove members from any group

• Add/remove owners from any group

• Manage dynamic membership rules

Limitations:

• Cannot modify role-assignable groups (requires RoleManagement.ReadWrite.Directory)

Abuse scenarios:

• Persistence: Create backdoor groups with elevated permissions

• Lateral movement: Add accounts to groups with Azure RBAC or application access

• Defense evasion: Remove security team members from monitoring groups

Identification

PowerShell (Microsoft Graph)

Connect-MgGraph -Scopes "Application.Read.All"

$permissionId = "62a82d76-70ea-41e2-9197-370581804d09"  # Group.ReadWrite.All
$graphSp = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"

Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $graphSp.Id -All | Where-Object { $_.AppRoleId -eq $permissionId } | ForEach-Object {
    $sp = Get-MgServicePrincipal -ServicePrincipalId $_.PrincipalId
    [PSCustomObject]@{ DisplayName = $sp.DisplayName; AppId = $sp.AppId }
} | Format-Table -AutoSize

Azure Portal

1. Microsoft Entra admin center -> Applications -> Enterprise applications

2. Select application -> Permissions -> Look for Group.ReadWrite.All

Exploitation

An attacker with Group.ReadWrite.All can add accounts to normal security groups and create backdoor groups.

For adding members to groups, see AZ_MG_ADD_MEMBER.

Mitigation

• Audit and remove unnecessary Group.ReadWrite.All grants

• Apply least privilege:

  • Use Group.Read.All if only read access is needed

  • Use GroupMember.ReadWrite.All if only membership management is needed

• Regular access reviews for applications with this permission

Detection

Use the Microsoft Entra admin center:

1. Open Microsoft Entra ID -> Audit logs.

2. Filter Activity for Add group, Delete group, and Add member to group.

3. Review Initiated by (actor), Target, Date, and Status for unexpected group changes.

4. Use Manage view -> Edit columns if any of those fields are hidden.

References

• https://learn.microsoft.com/en-us/graph/permissions-reference

• https://learn.microsoft.com/en-us/graph/api/group-post-groups

• https://learn.microsoft.com/en-us/graph/api/group-post-members