AZ_MG_GROUPMEMBER_READWRITE_ALL

Summary

Forestall ACL Alias	AZ_MG_GROUPMEMBER_READWRITE_ALL
Entra ID (Azure AD) Alias	GroupMember.ReadWrite.All
Affected Object Types	Service Principals, Applications
Exploitation Certainty	Certain
Graph Permission / Role	Application Permission: GroupMember.ReadWrite.All

Description

AZ_MG_GROUPMEMBER_READWRITE_ALL grants read and write access to group memberships in Microsoft Entra ID.

Capabilities:

• Add/remove members to security groups and Microsoft 365 groups

• Read group memberships and properties

Limitations:

• Cannot modify role-assignable groups (requires RoleManagement.ReadWrite.Directory)

• Cannot create/delete groups (requires Group.ReadWrite.All)

Abuse scenarios:

• Lateral movement: Add accounts to groups with Azure RBAC or application access

• Defense evasion: Remove security team members from monitoring groups

Identification

PowerShell (Microsoft Graph)

Connect-MgGraph -Scopes "Application.Read.All"

$permissionId = "dbaae8cf-10b5-4b86-a4a1-f871c94c6695"  # GroupMember.ReadWrite.All
$graphSp = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"

Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $graphSp.Id -All | Where-Object { $_.AppRoleId -eq $permissionId } | ForEach-Object {
    $sp = Get-MgServicePrincipal -ServicePrincipalId $_.PrincipalId
    [PSCustomObject]@{ DisplayName = $sp.DisplayName; AppId = $sp.AppId }
} | Format-Table -AutoSize

Azure Portal

1. Microsoft Entra admin center -> Applications -> Enterprise applications

2. Select application -> Permissions -> Look for GroupMember.ReadWrite.All

Exploitation

An attacker with GroupMember.ReadWrite.All can add accounts to normal security groups (not role-assignable groups).

For exploitation details, see AZ_MG_ADD_MEMBER.

Mitigation

• Audit and remove unnecessary GroupMember.ReadWrite.All grants

• Apply least privilege: Use GroupMember.Read.All if only read access is needed

• Regular access reviews for applications with this permission

Detection

Use the Microsoft Entra admin center:

1. Open Microsoft Entra ID -> Audit logs.

2. Filter Activity for Add member to group and Remove member from group.

3. Review Initiated by (actor), Target, Date, and Status for unexpected group membership changes.

4. Use Manage view -> Edit columns if any of those fields are hidden.

References

• https://learn.microsoft.com/en-us/graph/permissions-reference

• https://learn.microsoft.com/en-us/graph/api/group-post-members

• https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/groups-concept