AZ_PARENT

Summary

Forestall ACL Alias	AZ_PARENT
Azure Alias	Contains / Member of (Administrative Unit, Management Group, Subscription, Resource Group)
Affected Object Types	All Entra ID and ARM objects
Exploitation Certainty	Informational

Description

AZ_PARENT is the structural/containment edge for Microsoft Entra ID and Azure Resource Manager (ARM). It represents that Parent Y contains Child X, with the edge pointing from the parent to the child.

Parent	Children
Administrative Unit	Users, Groups, Devices
Management Group	Subscriptions, child Management Groups
Subscription	Resource Groups
Resource Group	VMs, Key Vaults, SQL Servers, Web Apps, Logic Apps, Function Apps, Automation Accounts, Managed Clusters, VM Scale Sets, and other ARM resources

This edge is not directly exploitable. It shows containment and how RBAC and directory roles inherit downward through the hierarchy.

For tenant-to-entity containment, see PARENT_TENANT.

Identification

Use the Azure Portal and Microsoft Entra admin center:

1. Open Microsoft Entra ID -> Overview for tenant-scoped identity objects.

2. Open Microsoft Entra ID -> Administrative units for AU membership.

3. Open Azure Portal -> Management groups for the MG hierarchy.

4. Open Azure Portal -> Subscriptions -> Resource groups for subscription and RG containment.

5. Open a Resource group -> Resources for contained ARM resources.

Exploitation

There is no direct exploit for this edge. It represents a containment relationship.

Higher parent scopes mean larger blast radius when a privileged role is compromised at Management Group, Subscription, or Resource Group level.

References

• https://learn.microsoft.com/en-us/entra/fundamentals/whatis

• https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/administrative-units

• https://learn.microsoft.com/en-us/azure/governance/management-groups/overview

• https://learn.microsoft.com/en-us/azure/role-based-access-control/scope-overview

• https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/overview