Skip to content
Forestall

AZ_PARENT

Copy page

Summary
Forestall ACL Alias AZ_PARENT
Azure Alias Contains / Member of (Administrative Unit, Management Group, Subscription, Resource Group)
Affected Object Types All Entra ID and ARM objects
Exploitation Certainty Informational

Description

AZ_PARENT is the structural/containment edge for Microsoft Entra ID and Azure Resource Manager (ARM). It represents that Parent Y contains Child X, with the edge pointing from the parent to the child.

Parent Children
Administrative Unit Users, Groups, Devices
Management Group Subscriptions, child Management Groups
Subscription Resource Groups
Resource Group VMs, Key Vaults, SQL Servers, Web Apps, Logic Apps, Function Apps, Automation Accounts, Managed Clusters, VM Scale Sets, and other ARM resources

This edge is not directly exploitable. It shows containment and how RBAC and directory roles inherit downward through the hierarchy.

For tenant-to-entity containment, see PARENT_TENANT.

Identification

Use the Azure Portal and Microsoft Entra admin center:

  1. Open Microsoft Entra ID -> Overview for tenant-scoped identity objects.
  2. Open Microsoft Entra ID -> Administrative units for AU membership.
  3. Open Azure Portal -> Management groups for the MG hierarchy.
  4. Open Azure Portal -> Subscriptions -> Resource groups for subscription and RG containment.
  5. Open a Resource group -> Resources for contained ARM resources.

Exploitation

There is no direct exploit for this edge. It represents a containment relationship.

Higher parent scopes mean larger blast radius when a privileged role is compromised at Management Group, Subscription, or Resource Group level.

References

Was this page helpful?

Thank you for your feedback.