PARENT_TENANT

Summary

Forestall ACL Alias	PARENT_TENANT
Azure Alias	Tenant Contains
Affected Object Types	Users, Groups, Applications, Service Principals, Devices, Roles, Subscriptions
Exploitation Certainty	Informational

Description

PARENT_TENANT is the structural/containment edge from a Microsoft Entra ID Tenant to its child objects. It represents that Tenant contains Entity, with the edge pointing from the tenant to the child.

Parent	Children
Tenant	Users, Groups, Applications, Service Principals, Devices, Roles, Subscriptions, and other tenant-scoped objects

This edge is not directly exploitable. It shows tenancy and how directory roles and permissions are scoped within the tenant boundary.

Related edges: AZ_PARENT.

Identification

Use the Azure Portal and Microsoft Entra admin center:

1. Open Microsoft Entra ID -> Overview to see the tenant and its scoped identity objects.

2. Open Microsoft Entra ID -> Users for tenant users.

3. Open Microsoft Entra ID -> Groups for tenant groups.

4. Open Microsoft Entra ID -> App registrations for tenant applications.

5. Open Microsoft Entra ID -> Enterprise applications for tenant service principals.

6. Open Microsoft Entra ID -> Devices for tenant devices.

7. Open Azure Portal -> Subscriptions for subscriptions associated with the tenant.

Exploitation

There is no direct exploit for this edge. It represents a containment relationship.

Tenant-level privileged roles (Global Administrator, Privileged Role Administrator, etc.) have full control over all child entities within the tenant.

References

• https://learn.microsoft.com/en-us/entra/fundamentals/whatis

• https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference

• https://learn.microsoft.com/en-us/entra/fundamentals/concept-learn-about-groups