Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Azure / Entra ID Glossary

The glossary explains how cloud identities, roles, and configurations are classified, how high-impact identities are identified, and how privilege levels affect security within Azure environments.

Azure / Entra ID Objects

The scan analyzes the following identity and configuration objects within Azure environments.

  • Tenants

  • Users

  • Groups

  • Devices

  • Applications

  • Service Principals

  • Roles

  • Administrative Units

  • Conditional Access Policies

Azure Resource Management objects:

  • Management Groups, Subscriptions and Resource Groups

  • ARM Roles

  • Virtual Machines and VM Scale Sets

  • Key Vaults and SQL Servers

  • Web Apps, Function Apps and Logic Apps

  • Automation Accounts

  • Managed Clusters and Container Registries

  • Storage Accounts

  • User Assigned Identities

Microsoft 365 objects:

  • Teams Settings, Teams Meeting Policies, Teams Messaging Policies and Teams External Access

  • SharePoint Settings and SharePoint Sites

Tier 0 (Azure / Entra ID)

What “Tier 0” Means in Azure

Tier 0 identities in Azure represent control over the entire Azure / Entra ID tenant and its identity control plane. Any identity, role, or configuration that can manage authentication, authorization, role assignments, or security policies at the tenant level is considered Tier 0.

Compromise of a Tier 0 identity can result in full control over users, groups, applications, devices, and cloud resources within the tenant.

For this reason, Tier 0 identities must be tightly protected and managed only through secure administrative access by the most-trusted administrators.

Which Azure Objects Are Always Tier 0

The following Azure / Entra ID objects are always considered Tier 0 due to their ability to control the tenant-wide identity and security boundary.

  • Azure / Entra ID Tenant

  • Azure subscriptions

  • The Entra ID roles Global Administrator, Privileged Role Administrator, Privileged Authentication Administrator, Security Administrator, Intune Administrator and Partner Tier2 Support

  • Custom Entra ID roles with tenant-wide administrative permissions

  • The Azure (ARM) roles Owner, Contributor, User Access Administrator, Role Based Access Control Administrator and Reservations Administrator, and custom ARM roles with equivalent permissions at subscription scope or higher

How Azure Objects Get Their Tier

In Azure environments, the tier of an object is determined by the scope of permissions, role assignments, and relationships to Tier 0 identities.

Objects that are not inherently Tier 0 can become Tier 0 or Privileged through direct or indirect role assignments, delegated administrative permissions, or control over Tier 0 identities.

Forestall determines the effective tier of Azure objects by analyzing role scopes, assignment chains, and privilege relationships during Azure scans. Users, groups and service principals assigned to a Tier 0 role, directly or through group membership, become Tier 0. For ARM roles the assignment must be at subscription scope or higher.

All other Azure objects, including the other Entra ID and ARM roles and Azure resources, are labelled Tier 2.

Privileged (Azure / Entra ID)

Privileged objects in Azure are identities, roles, or configurations that have high-impact permissions over Azure / Entra ID resources or security controls, but do not represent full tenant-level control.

These objects can significantly affect users, applications, devices, or security settings and may be leveraged to indirectly compromise Tier 0 identities.

Forestall marks the following types of objects as Privileged in Azure environments:

  • Azure roles with high-impact administrative permissions

  • Identities assigned to roles that manage users, roles, or security configurations

  • Service Principals or applications with broad directory or management permissions

  • Objects with delegated permissions that can modify privileged identities or policies

Unprivileged (Azure / Entra ID)

Unprivileged objects in Azure are identities and roles that do not have elevated administrative permissions and cannot directly or indirectly compromise Tier 0 or Privileged objects.

These objects typically have limited scope and impact within the Azure / Entra ID environment.

All Azure objects that are not classified as Tier 0 or Privileged are considered Unprivileged by Forestall.

Everyone-Like (Azure / Entra ID)

Everyone-Like objects in Azure are identities, groups, or configurations that implicitly or broadly include a large portion of the tenant, resulting in wide-reaching access or impact.

These objects do not necessarily grant high privileges on their own, but their broad membership or scope can significantly increase the attack surface and amplify the impact of misconfigurations or privilege escalation paths.

Forestall uses the Everyone-Like classification to identify Azure objects that represent broad or implicit access across the tenant.

Shadow Admin (Azure / Entra ID)

Shadow Admin objects in Azure are identities, roles, or configurations that are not explicitly classified as Tier 0 or Privileged, but can indirectly compromise Tier 0 identities or gain high-impact control through role assignments, delegated permissions, or privilege relationships.

These objects may enable privilege escalation paths that result in tenant-level impact without being immediately obvious as administrative identities.

Forestall identifies Azure Shadow Admins by analyzing role scopes, permission delegations, and indirect control paths within the Azure / Entra ID environment.

PreviousActive Directory Glossary
NextAWS / IAM Glossary

Last updated

Was this helpful?