AZ_MG_SERVICEPRINCIPALENDPOINT_READWRITE_ALL

Copy page

Summary


Forestall ACL Alias	AZ_MG_SERVICEPRINCIPALENDPOINT_READWRITE_ALL
Entra ID (Azure AD) Alias	ServicePrincipalEndpoint.ReadWrite.All
Affected Object Types	Service Principals
Exploitation Certainty	Certain
Graph Permission / Role	Application Permission: ServicePrincipalEndpoint.ReadWrite.All

Description

AZ_MG_SERVICEPRINCIPALENDPOINT_READWRITE_ALL represents a Microsoft Graph application permission that grants the ability to read and write service principal properties including endpoints and owners.

Capabilities (verified):

Add owners to service principals
Modify endpoint URLs including reply URLs and redirect URIs
Update service principal properties
Read service principal configurations

Security Implications:

This permission is dangerous because an attacker can:

Add themselves as owner of a service principal for persistence
Redirect authentication flows by modifying redirect URIs to capture OAuth tokens
Token theft by adding malicious reply URLs to steal access tokens
Persistence through backdoor endpoints that remain after credential rotation

Comparison with similar permissions:

Permission	Modify replyUrls	Add Owners	Add Credentials
ServicePrincipalEndpoint.ReadWrite.All	Yes	Yes	No
Application.ReadWrite.All	Yes	Yes	Yes
Directory.ReadWrite.All	Yes	Yes	Yes

Identification

PowerShell (Microsoft Graph)

Find Service Principals with ServicePrincipalEndpoint.ReadWrite.All:

Connect-MgGraph -Scopes "Application.Read.All","Directory.Read.All"

# ServicePrincipalEndpoint.ReadWrite.All permission ID (correct GUID)
$permissionId = "89c8469c-83ad-45f7-8ff2-6e3d4285709e"

# Get Microsoft Graph service principal (resource)
$graphSp = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"

# Find all app role assignments for this permission
Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $graphSp.Id -All | Where-Object { $_.AppRoleId -eq $permissionId } | ForEach-Object {
    $sp = Get-MgServicePrincipal -ServicePrincipalId $_.PrincipalId
    [PSCustomObject]@{
        DisplayName      = $sp.DisplayName
        AppId            = $sp.AppId
        ServicePrincipalId = $sp.Id
        Permission       = "ServicePrincipalEndpoint.ReadWrite.All"
        AssignedDate     = $_.CreatedDateTime
    }
} | Format-Table -AutoSize

Exploitation

An attacker with ServicePrincipalEndpoint.ReadWrite.All can add owners and modify service principal endpoints.

For adding owners to service principals, see AZ_ADD_OWNER.

Common Abuse Patterns

Add attacker as owner for persistent access
Modify redirect URIs to intercept OAuth tokens
Changes persist after credential rotation

Mitigation

Audit service principals with ServicePrincipalEndpoint.ReadWrite.All and remove unnecessary grants
- Go to Microsoft Entra ID -> App registrations -> select application -> API permissions
- Remove the permission if not required
Monitor owner additions on service principals:
- Alert on new owners added to sensitive service principals
- Review audit logs for owner changes
Implement strict reply URL policies:
- Use exact match redirect URIs instead of wildcards
- Limit reply URLs to known, trusted domains
- Block localhost and HTTP (non-HTTPS) redirect URIs in production
Monitor redirect URI changes on service principals:
- Review audit logs for modifications to service principal configurations
- Alert on unexpected reply URL additions
Regular audits: Periodically review service principal owners and endpoints

Detection

Use the Microsoft Entra admin center:

Open Microsoft Entra ID -> Audit logs.
Filter Activity for Add owner to service principal and Update service principal.
Review Initiated by (actor), Target, Date, and Status for unexpected owner or endpoint changes.
Open the affected Enterprise application and review Owners plus redirect URI or endpoint-related settings for unexpected additions.
Use Manage view -> Edit columns if any of those fields are hidden.

Ask AI