Skip to content
Forestall

AZ_PARTNER_TIER2_SUPPORT

Copy page

WARNING: This role is deprecated. Microsoft states: “Do not use - not intended for general use.” Organizations should transition to Granular Delegated Admin Privileges (GDAP).

Summary
Forestall ACL Alias AZ_PARTNER_TIER2_SUPPORT
Entra ID (Azure AD) Alias Partner Tier2 Support
Role Template ID e00e864a-17c5-4a4b-9c06-f5b95a8d5bd8
Affected Object Types Users, Service Principals, Groups, Domains, Role Assignments
Exploitation Certainty Certain
Graph Permission / Role Membership in the Partner Tier2 Support directory role

Description

AZ_PARTNER_TIER2_SUPPORT represents the Partner Tier2 Support directory role in Microsoft Entra ID. This role was assigned to Microsoft Partner organizations through the Cloud Solution Provider (CSP) or Delegated Admin Privileges (DAP) programs.

Capabilities of Partner Tier2 Support:

  • Reset passwords for ALL users including Global Administrators
  • Invalidate refresh tokens for all users including admins
  • Full domain management (create, delete, update domains)
  • Manage role assignments (create/delete role assignments)
  • Manage user accounts including creation, modification, and deletion
  • Manage groups and group memberships
  • Update applications and credentials
  • Create and manage OAuth permission grants

Partner Tier2 vs Tier1 Support:

Capability Tier1 Tier2
Reset passwords for non-admins Yes Yes
Reset passwords for admins (including GA) No Yes
Domain management No Yes
Role assignment management No Yes

Security Implications:

This role is extremely dangerous because:

  • Password reset for Global Admins: One of very few roles that can reset GA passwords
  • External access: The role is held by principals from an external partner tenant
  • Nation-state abuse: NOBELIUM (APT29) abused DAP relationships to compromise multiple tenants
  • Cross-tenant trust: Actions are performed by entities outside your organizational control
  • Persistence: Partners may retain access even after business relationships end
  • Visibility gaps: Partner actions may not be as visible in customer audit logs

Identification

PowerShell (Microsoft Graph)

Find Partner Tier2 Support role assignments:

Connect-MgGraph -Scopes "RoleManagement.Read.Directory","Directory.Read.All"


# Partner Tier2 Support role template ID
$roleId = "e00e864a-17c5-4a4b-9c06-f5b95a8d5bd8"


Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '$roleId'" -ExpandProperty Principal -ErrorAction SilentlyContinue | ForEach-Object {
    [PSCustomObject]@{
        PrincipalType = $_.Principal.AdditionalProperties.'@odata.type'.Split('.')[-1]
        DisplayName   = $_.Principal.AdditionalProperties.displayName
        PrincipalId   = $_.PrincipalId
        Scope         = $_.DirectoryScopeId
    }
} | Format-Table -AutoSize

Check for all partner roles and GDAP relationships:

# Check both Partner Tier1 and Tier2
$partnerRoles = @{
    "4ba39ca4-527c-499a-b93d-d9b492c50246" = "Partner Tier1 Support"
    "e00e864a-17c5-4a4b-9c06-f5b95a8d5bd8" = "Partner Tier2 Support"
}


$partnerRoles.Keys | ForEach-Object {
    $rid = $_; $rname = $partnerRoles[$_]
    Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '$rid'" -ExpandProperty Principal -ErrorAction SilentlyContinue | ForEach-Object {
        [PSCustomObject]@{ Role = $rname; DisplayName = $_.Principal.AdditionalProperties.displayName; PrincipalId = $_.PrincipalId }
    }
} | Format-Table -AutoSize


# Check GDAP relationships
Connect-MgGraph -Scopes "DelegatedAdminRelationship.Read.All"
Get-MgTenantRelationshipDelegatedAdminRelationship | Select DisplayName,Status,Duration,EndDateTime | Format-Table -AutoSize

Exploitation

A compromised partner account with Tier2 Support can take over any account in the tenant, including Global Administrators. The core primitive is resetting a target user’s password—see the AZ_RESET_PASSWORD edge for the dedicated password-reset abuse details.

Real-world abuse: In 2021, NOBELIUM (APT29/Cozy Bear) targeted MSP/CSP partners and abused DAP relationships to pivot into multiple customer tenants.

PowerShell (Microsoft Graph)

Reset a Global Administrator’s password:

Connect-MgGraph -Scopes "User.ReadWrite.All"


$targetUser = "[email protected]"
Update-MgUser -UserId $targetUser -BodyParameter @{
    passwordProfile = @{
        forceChangePasswordNextSignIn = $false
        password = "pass here"
    }
}
Reset a Global Administrator password with PowerShell

Reset a Global Administrator password with PowerShell

Common Abuse Patterns

  • Reset Global Admin password and lock out legitimate administrators
  • Create new admin accounts for persistence
  • Modify OAuth app permissions for data exfiltration
  • Pivot from one compromised partner to multiple customer tenants

Mitigation

  • Transition from DAP to GDAP: Migrate to Granular Delegated Admin Privileges for time-bound, least-privilege access

    • Go to Microsoft 365 Admin Center -> Settings -> Partner relationships
    • Set maximum duration (recommend 90 days or less)

  • Review partner relationships regularly:

    • Audit which partners have access to your tenant
    • Remove partner relationships no longer needed
    • Verify partner identity before approving GDAP requests

  • Never grant Partner Tier2 Support under GDAP:

    • Use least-privilege roles (Helpdesk Administrator, User Administrator)
    • Avoid granting password reset capability over admin accounts

  • Monitor partner actions:

    • Review audit logs for actions by partner accounts
    • Alert on password resets by external principals
    • Monitor cross-tenant sign-ins

  • Require MFA for partner access: Ensure partners use phishing-resistant MFA

Detection

Use the Microsoft Entra admin center:

  1. Open Microsoft Entra ID -> Audit logs.
  2. Filter Activity for Reset password, Update user, and Add member to role.
  3. Review Initiated by (actor) for external partner principals and Target for administrator accounts or other sensitive users.
  4. Open Sign-in logs and review cross-tenant partner sign-ins where available.
  5. Use Manage view -> Edit columns if tenant, actor, target, or status fields are hidden.

References

Was this page helpful?

Thank you for your feedback.