AZ_MG_GROUPMEMBER_READWRITE_ALL

Copy page

Summary


Forestall ACL Alias	AZ_MG_GROUPMEMBER_READWRITE_ALL
Entra ID (Azure AD) Alias	GroupMember.ReadWrite.All
Affected Object Types	Service Principals, Applications
Exploitation Certainty	Certain
Graph Permission / Role	Application Permission: GroupMember.ReadWrite.All

Description

AZ_MG_GROUPMEMBER_READWRITE_ALL grants read and write access to group memberships in Microsoft Entra ID.

Capabilities:

Add/remove members to security groups and Microsoft 365 groups
Read group memberships and properties

Limitations:

Cannot modify role-assignable groups (requires RoleManagement.ReadWrite.Directory)
Cannot create/delete groups (requires Group.ReadWrite.All)

Abuse scenarios:

Lateral movement: Add accounts to groups with Azure RBAC or application access
Defense evasion: Remove security team members from monitoring groups

Identification

PowerShell (Microsoft Graph)

Connect-MgGraph -Scopes "Application.Read.All"

$permissionId = "dbaae8cf-10b5-4b86-a4a1-f871c94c6695"  # GroupMember.ReadWrite.All
$graphSp = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"

Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $graphSp.Id -All | Where-Object { $_.AppRoleId -eq $permissionId } | ForEach-Object {
    $sp = Get-MgServicePrincipal -ServicePrincipalId $_.PrincipalId
    [PSCustomObject]@{ DisplayName = $sp.DisplayName; AppId = $sp.AppId }
} | Format-Table -AutoSize

Exploitation

An attacker with GroupMember.ReadWrite.All can add accounts to normal security groups (not role-assignable groups).

For exploitation details, see AZ_MG_ADD_MEMBER.

Mitigation

Audit and remove unnecessary GroupMember.ReadWrite.All grants
Apply least privilege: Use GroupMember.Read.All if only read access is needed
Regular access reviews for applications with this permission

Detection

Use the Microsoft Entra admin center:

Open Microsoft Entra ID -> Audit logs.
Filter Activity for Add member to group and Remove member from group.
Review Initiated by (actor), Target, Date, and Status for unexpected group membership changes.
Use Manage view -> Edit columns if any of those fields are hidden.

Ask AI