> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/azure/az_add_members.md). # AZ\_ADD\_MEMBERS ## Summary | | | | --------------------------- | --------------------------------------------------------------------------------------------------- | | **FSProtect ACL Alias** | AZ\_ADD\_MEMBERS | | **Entra ID Alias** | Add Members (Group) | | **Affected Object Types** | AZ Group | | **Exploitation Certainty** | Certain | | **Graph Permission / Role** | Directory roles (e.g., **Groups Administrator**, **User Administrator**) or being a **Group Owner** | ## Description `AZ_ADD_MEMBERS` represents the ability for a principal (user, service principal, or group owner) to **add members to a Microsoft Entra ID group**. By adding themselves (or a controlled identity) into a **privileged group**, an attacker can: * Inherit **Azure RBAC** permissions if the group is assigned to subscriptions/resource groups/resources. * Inherit **directory roles** when the group is **role-assignable** (`isAssignableToRole = true`). Therefore, any identity with add-member capability on sensitive groups can quickly escalate privileges by modifying group membership. ## Identification ### PowerShell ```powershell # Requires: Install-Module Microsoft.Graph -Scope CurrentUser # Connect-MgGraph -Scopes "Directory.Read.All","Group.Read.All","RoleManagement.Read.Directory" # Get users in privileged roles that can add group members $roles = @('Global Administrator','Privileged Role Administrator','Groups Administrator','User Administrator') $roleMembers = Get-MgDirectoryRole -All | Where-Object { $_.DisplayName -in $roles } | ForEach-Object { $role = $_.DisplayName Get-MgDirectoryRoleMember -DirectoryRoleId $_.Id -All | ForEach-Object { [pscustomobject]@{ Role = $role; Member = $_.AdditionalProperties['displayName']; Id = $_.Id } } } # Get all group owners $groupOwners = Get-MgGroup -All | ForEach-Object { $g = $_ Get-MgGroupOwner -GroupId $g.Id -All -ErrorAction SilentlyContinue | ForEach-Object { [pscustomobject]@{ Group = $g.DisplayName Owner = $_.AdditionalProperties['displayName'] Type = ($_.AdditionalProperties['@odata.type'] -replace '#microsoft.graph.','') } } } "=== PRIVILEGED ROLE MEMBERS ===" $roleMembers | Format-Table -AutoSize "=== GROUP OWNERS ===" $groupOwners | Sort-Object Group | Format-Table -AutoSize ``` ### Azure CLI Check owners and (if you are owner or hold the right role) add a member: ```bash # List group owners az ad group owner list --group "" --query "[].{displayName:displayName,id:id}" # Add a member (requires owner/appropriate role) az ad group member add --group "" --member-id "" ``` ### Azure Portal * Open **Microsoft Entra admin center** -> **Groups** -> select the **target group**. * Go to **Owners** and list all identities shown there. * **Anyone listed as Owner can add members** to this group. ![Group owners in the Entra admin center](https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-154430596aa8ce734faa022983f742a37bfe6fd4%2Fazure-az_add_members-image-1.png?alt=media) * Go to **Properties** and check **"Is this group assignable to roles in Entra ID?"** * If **True** (role-assignable): only **Global Administrator (GA)** and **Privileged Role Administrator (PRA)** (besides Owners) can add members. * If **False**: **GA, PRA, Groups Administrator (GAd), User Administrator (UAd)** (besides Owners) can add members. ![Group role-assignable property in the Entra admin center](https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-89e13e41a121401c55cb583271882aa4d8648d25%2Fazure-az_add_members-image-2.png?alt=media) * Go to **Roles & administrators** and open each relevant role (GA, PRA, GAd, UAd). * In each role -> **Assignments**: list the **users** and **groups** that hold the role. * If a **group** holds the role, enumerate its **transitive members** (nested included) to get the **effective users** who can add members. ![Groups Administrator role assignments in Entra admin center](https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-0189f37a02ca4cd3999157785fa4232bc9d00d78%2Fazure-az_add_members-image-3.png?alt=media) ## Exploitation Group ownership is one of the primary ways to obtain add-member capability over a group. See the [AZ\_OWNER](https://docs.forestall.io/fsprotect/edges/azure/az_owner) edge for how object ownership in Entra ID grants this and related privileges. ### PowerShell ```powershell # Using Microsoft Graph PowerShell SDK Connect-MgGraph -Scopes "GroupMember.ReadWrite.All" $group = Get-MgGroup -Filter "displayName eq 'IT Admins'" $user = Get-MgUser -UserId "anyuser@fscloudlab.onmicrosoft.com" New-MgGroupMember -GroupId $group.Id -DirectoryObjectId $user.Id ``` ![Add a group member with Microsoft Graph PowerShell](https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-58961c048f2d13d5934d2dacaac85c55af740537%2Fazure-az_add_members-image-4.png?alt=media) ### Azure Portal * Go to **Microsoft Entra ID** -> **Groups**. * Locate the target group using **Search** or filters, and **open** the group. * Open **Members** (left menu of the group blade). * Click **Add members**. * In the picker dialog: * Search for the identity you want to insert. * Select the identity and click **Select** (or **Add**) to confirm. ## Mitigation * Fewer Owners means fewer identities that can add members; this directly reduces lateral-movement and privilege-escalation risk, especially for role-assignable or production-impacting groups. * Go to **Microsoft Entra ID** -> **Groups** -> **All groups**. * Filter or search to find **groups** that you want to remove owner(s). * Open a **target group**. * Open **Owners**. * **Remove** any **vulnerable/high-risk identities**. * **Remove unnecessary / vulnerable user assignees from a role** * Go to **Microsoft Entra ID** -> **Roles & administrators**. * In the search box, type the exact role name (e.g., **Global Administrator**) and **click** the role. * In the left menu, **click** **Assignments**. * Ensure **Active assignments** is selected. * Find the **user** you want to remove. * At the right of that row, **click** **... (More options)** -> **Remove assignment**. * In the confirmation dialog, **click** **Remove**. ## Detection Use the Microsoft Entra admin center: 1. Open **Microsoft Entra ID** -> **Audit logs**. 2. Click **Category: All** -> select **GroupManagement** -> **Apply**. 3. Filter or review **Activity** for **Add member to group**. 4. Review **Initiated by (actor)**, **Target**, **Date**, and **Status** for unexpected group membership additions. 5. Use **Manage view -> Edit columns** if any of those fields are hidden. ![Group membership changes in directory audit logs](https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-d12f9e9fb2da4f73c3e4ad72e35e6c3af83745d1%2Fazure-az_add_members-image-5.png?alt=media) ## References * * * *