AZ_MG_ADD_MEMBER

Summary

FSProtect ACL Alias	AZ_MG_ADD_MEMBER
Entra ID (Azure AD) Alias	Add Members (Microsoft Graph)
Affected Object Types	AZ Group
Exploitation Certainty	Certain
Graph Permission / Role	Ability to add group members through Microsoft Graph using delegated scopes and/or application permissions (app role assignments) such as: GroupMember.ReadWrite.All, Group.ReadWrite.All, Directory.ReadWrite.All For role-assignable groups, permissions that allow directory role management operations (e.g., RoleManagement.ReadWrite.Directory) may be required depending on configuration and policy

---

Description

AZ_MG_ADD_OWNER represents the ability for a principal to add new owners to a Microsoft Entra group via Microsoft Graph. By adding themselves (or a controlled identity) as an Owner of a sensitive group, an attacker can:

• Gain full administrative control over the group (manage members, owners, and group settings).

• Add or remove other owners to maintain persistence.

• If the group is role-assignable (isAssignableToRole = true), indirectly control directory roles and any access granted through that group (including downstream Azure RBAC assignments where that group is used).

Therefore, any identity with add-owner capability on sensitive groups can quickly escalate privileges by taking ownership of privileged or role-assignable groups.

---

Identification

PowerShell (Microsoft Graph)

Install-Module Microsoft.Graph
Import-Module Microsoft.Graph

$ErrorActionPreference ='Stop'
Connect-MgGraph-Scopes"AppRoleAssignment.Read.All","Application.Read.All","Directory.Read.All"

$msGraphAppId ="00000003-0000-0000-c000-000000000000"
$graphSp =Get-MgServicePrincipal-Filter"appId eq '$msGraphAppId'"-Property Id,AppRoles

$targetAppPerms =@(
"Directory.ReadWrite.All",
"Group.ReadWrite.All",
"GroupMember.ReadWrite.All",
"RoleManagement.ReadWrite.Directory"
)

$roleMap =@{}
$graphSp.AppRoles |
Where-Object {$_.IsEnabled-and$_.Value-in$targetAppPerms } |
ForEach-Object {$roleMap[$_.Value] =$_.Id }

$results =@()

$allSps =Get-MgServicePrincipal-All-Property Id,AppId,DisplayName
foreach ($spin$allSps) {
$assignments =$null
try {$assignments =Get-MgServicePrincipalAppRoleAssignment-ServicePrincipalId$sp.Id-All }
catch {continue }

$hits =$assignments |Where-Object {
$_.ResourceId-eq$graphSp.Id-and ($roleMap.Values-contains$_.AppRoleId)
  }

foreach ($hin$hits) {
$permName = ($roleMap.GetEnumerator() |Where-Object {$_.Value-eq$h.AppRoleId }).Key
$results += [pscustomobject]@{
      ServicePrincipalDisplayName =$sp.DisplayName
      ServicePrincipalId          =$sp.Id
      ServicePrincipalAppId       =$sp.AppId
      GraphApplicationPermission  =$permName
    }
  }
}

"=== SERVICE PRINCIPALS WITH GRAPH APP PERMISSIONS THAT CAN ADD GROUP MEMBERS ==="
$results |Sort-Object GraphApplicationPermission, ServicePrincipalDisplayName |Format-Table-AutoSize

Azure GUI

• Open Microsoft Entra admin center → Identity → Applications → Enterprise applications.

• Select the application (service principal) that is in scope.

• Open Permissions (or API permissions).

• Under Microsoft Graph:

  • Review Application permissions for:

    • Directory.ReadWrite.All

    • Group.ReadWrite.All

    • GroupMember.ReadWrite.All

    • RoleManagement.ReadWrite.Directory

• Record every service principal that has any of these permissions, and identify the business owner and justification.

---

Exploitation

PowerShell

Install-Module Microsoft.Graph
Import-Module Microsoft.Graph

$ErrorActionPreference ='Stop'
Connect-MgGraph -Scopes "GroupMember.ReadWrite.All","Group.ReadWrite.All","Directory.ReadWrite.All"

# Resolve target group and target user
$group = Get-MgGroup -Filter "displayName eq 'Example'"
$user  = Get-MgUser -UserId "[email protected]"

# Add user to group (Graph members/$ref)
New-MgGroupMemberByRef -GroupId $group.Id `
-OdataId ("https://graph.microsoft.com/v1.0/directoryObjects/{0}" -f $user.Id)

Azure GUI

1

Step 1 — Open Graph Explorer

Open Microsoft Graph Explorer at: https://developer.microsoft.com/en-us/graph/graph-explorer and sign in with an account that has a scope permitting group write operations (e.g., Group.ReadWrite.All or Directory.ReadWrite.All).

2

Step 2 — Retrieve group id

Request:

GET https://graph.microsoft.com/v1.0/groups?$filter=displayName eq 'My Group'

3

Step 3 — Retrieve member object id

For a user, request:

GET https://graph.microsoft.com/v1.0/users/{userPrincipalName}

4

Step 4 — Add the member to the group

POST to:

https://graph.microsoft.com/v1.0/groups/{group-id}/members/$ref

Request body:

{ "@odata.id": "https://graph.microsoft.com/v1.0/directoryObjects/{member-object-id}" }

5

Step 5 — Confirm membership

GET https://graph.microsoft.com/v1.0/groups/{group-id}/members?$select=id,displayName

(Images referenced in the original content are retained inline where they appeared.)

---

Mitigation

• Reduce who can grant group membership via Microsoft Graph application permissions

  • Go to Microsoft Entra admin center → Identity → Applications → Enterprise applications.

  • Select the target application (service principal / managed identity).

  • Open Permissions (or API permissions).

  • Under Microsoft Graph → Application permissions, locate any of the following high-impact permissions:

    • Directory.ReadWrite.All

    • Group.ReadWrite.All

    • GroupMember.ReadWrite.All

    • RoleManagement.ReadWrite.Directory

  • If any are present and not strictly required:

    • Remove the permission, or replace with a lower-privilege

    • Ensure the change is admin-consented appropriately (removal will take effect after consent state is updated).

• Restrict who can approve (admin consent) privileged Graph application permissions

  • Go to Microsoft Entra admin center → Identity → Enterprise applications → Consent and permissions.

  • Review and tighten who can:

    • Grant tenant-wide admin consent, and

    • Approve requests for application permissions to Microsoft Graph.

• Remove unnecessary owners / administrators on the service principal

  • Go to Microsoft Entra admin center → Identity → Applications → Enterprise applications.

  • Select the target application.

  • Open Owners.

  • Remove any vulnerable/high-risk identities and keep the owner set minimal.

  • Limit administrative access to the application to only the identities responsible for operating it.

---

Detection

Detect “Add member to group” directly in Audit logs.

• Go to Microsoft Entra ID → Audit logs.

• Click Category: All → select GroupManagement → Apply.

• If the Activity column is hidden: Manage view → Edit columns → check Activity, Initiated by (actor), Target → Apply.

(Original image references retained inline.)

---

References

• https://learn.microsoft.com/en-us/graph/api/group-post-members?view=graph-rest-1.0

• https://learn.microsoft.com/en-us/graph/permissions-reference

• https://learn.microsoft.com/en-us/graph/permissions-overview

• https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.applications/get-mgserviceprincipal?view=graph-powershell-1.0

• https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.applications/get-mgserviceprincipalapproleassignment?view=graph-powershell-1.0

• https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-activity-log-schemas

• https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities

• https://learn.microsoft.com/en-us/cli/azure/reference-index?view=azure-cli-latest