Summary
| Forestall ACL Alias | PARENT_TENANT |
| Azure Alias | Tenant Contains |
| Affected Object Types | Users, Groups, Applications, Service Principals, Devices, Roles, Subscriptions |
| Exploitation Certainty | Informational |
Description
PARENT_TENANT is the structural/containment edge from a Microsoft Entra ID Tenant to its child objects. It represents that Tenant contains Entity, with the edge pointing from the tenant to the child.
| Parent | Children |
|---|---|
| Tenant | Users, Groups, Applications, Service Principals, Devices, Roles, Subscriptions, and other tenant-scoped objects |
This edge is not directly exploitable. It shows tenancy and how directory roles and permissions are scoped within the tenant boundary.
Related edges: AZ_PARENT.
Identification
Use the Azure Portal and Microsoft Entra admin center:
- Open Microsoft Entra ID -> Overview to see the tenant and its scoped identity objects.
- Open Microsoft Entra ID -> Users for tenant users.
- Open Microsoft Entra ID -> Groups for tenant groups.
- Open Microsoft Entra ID -> App registrations for tenant applications.
- Open Microsoft Entra ID -> Enterprise applications for tenant service principals.
- Open Microsoft Entra ID -> Devices for tenant devices.
- Open Azure Portal -> Subscriptions for subscriptions associated with the tenant.
Exploitation
There is no direct exploit for this edge. It represents a containment relationship.
Tenant-level privileged roles (Global Administrator, Privileged Role Administrator, etc.) have full control over all child entities within the tenant.