> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/edges/azure/az_parent.md).

# AZ\_PARENT

## Summary

|                            |                                                                                            |
| -------------------------- | ------------------------------------------------------------------------------------------ |
| **Forestall ACL Alias**    | AZ\_PARENT                                                                                 |
| **Azure Alias**            | Contains / Member of (Administrative Unit, Management Group, Subscription, Resource Group) |
| **Affected Object Types**  | All Entra ID and ARM objects                                                               |
| **Exploitation Certainty** | Informational                                                                              |

## Description

`AZ_PARENT` is the structural/containment edge for Microsoft Entra ID and Azure Resource Manager (ARM). It represents that **Parent Y contains Child X**, with the edge pointing from the parent to the child.

| Parent                  | Children                                                                                                                                         |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Administrative Unit** | Users, Groups, Devices                                                                                                                           |
| **Management Group**    | Subscriptions, child Management Groups                                                                                                           |
| **Subscription**        | Resource Groups                                                                                                                                  |
| **Resource Group**      | VMs, Key Vaults, SQL Servers, Web Apps, Logic Apps, Function Apps, Automation Accounts, Managed Clusters, VM Scale Sets, and other ARM resources |

This edge is not directly exploitable. It shows containment and how RBAC and directory roles inherit downward through the hierarchy.

For tenant-to-entity containment, see [PARENT\_TENANT](https://docs.forestall.io/fsprotect/edges/azure/parent_tenant).

## Identification

Use the Azure Portal and Microsoft Entra admin center:

1. Open **Microsoft Entra ID** -> **Overview** for tenant-scoped identity objects.
2. Open **Microsoft Entra ID** -> **Administrative units** for AU membership.
3. Open **Azure Portal** -> **Management groups** for the MG hierarchy.
4. Open **Azure Portal** -> **Subscriptions** -> **Resource groups** for subscription and RG containment.
5. Open a **Resource group** -> **Resources** for contained ARM resources.

## Exploitation

There is no direct exploit for this edge. It represents a containment relationship.

Higher parent scopes mean larger blast radius when a privileged role is compromised at Management Group, Subscription, or Resource Group level.

## References

* <https://learn.microsoft.com/en-us/entra/fundamentals/whatis>
* <https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/administrative-units>
* <https://learn.microsoft.com/en-us/azure/governance/management-groups/overview>
* <https://learn.microsoft.com/en-us/azure/role-based-access-control/scope-overview>
* <https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/overview>