AZ_MG_GRANT_APP_ROLES

Summary

FSProtect ACL Alias	AZ_MG_GRANT_APP_ROLES
Entra ID (Azure AD) Alias	Grant App Roles (Microsoft Graph)
Affected Object Types	Service Principals (Enterprise applications), Users, Groups
Exploitation Certainty	Certain
Graph Permission / Role	Ability to create app role assignments via Microsoft Graph using delegated scopes and/or application permissions such as: AppRoleAssignment.ReadWrite.All, Directory.ReadWrite.All and/or directory roles such as Application Administrator, Cloud Application Administrator, Privileged Role Administrator, Global Administrator

Description

AZ_MG_GRANT_APP_ROLES represents the ability for a principal to grant app roles via Microsoft Graph by creating app role assignments.

App role assignments can be granted to:

• A service principal (enterprise application).

• A user.

• A group.

By granting an app role to a controlled identity, an attacker can:

• Assign high-privilege application permissions to a service principal (for example, by assigning Microsoft Graph app roles), then authenticate as that app and act with those privileges.

• Assign roles in line-of-business applications that gate access to sensitive data or administrative features.

• Establish persistence by granting roles to long-lived identities (service principals / managed identities).

Therefore, any identity that can grant app roles through Microsoft Graph can quickly escalate privileges or expand access by modifying app role assignments.

Identification

PowerShell (Microsoft Graph)

Enumerate service principals that have Microsoft Graph application permissions that are sufficient to create app role assignments (for example, AppRoleAssignment.ReadWrite.All or Directory.ReadWrite.All).

Install-Module Microsoft.Graph-Scope CurrentUser
Import-Module Microsoft.Graph

$ErrorActionPreference ='Stop'

Connect-MgGraph-Scopes"Application.Read.All","AppRoleAssignment.Read.All","Directory.Read.All"

$msGraphAppId ="00000003-0000-0000-c000-000000000000"
$graphSp =Get-MgServicePrincipal-Filter"appId eq '$msGraphAppId'"-Property Id,AppRoles

$targetAppPerms =@(
"AppRoleAssignment.ReadWrite.All",
"Directory.ReadWrite.All"
)

$roleMap =@{}
$graphSp.AppRoles |
Where-Object {$_.IsEnabled-and$_.Value-in$targetAppPerms } |
ForEach-Object {$roleMap[$_.Value] =$_.Id }

$results =@()

$allSps =Get-MgServicePrincipal-All-Property Id,AppId,DisplayName
foreach ($spin$allSps) {
$assignments =$null
try {$assignments =Get-MgServicePrincipalAppRoleAssignment-ServicePrincipalId$sp.Id-All }
catch {continue }

$hits =$assignments |Where-Object {
$_.ResourceId-eq$graphSp.Id-and ($roleMap.Values-contains$_.AppRoleId)
  }

foreach ($hin$hits) {
$permName = ($roleMap.GetEnumerator() |Where-Object {$_.Value-eq$h.AppRoleId }).Key
$results += [pscustomobject]@{
      ServicePrincipalDisplayName =$sp.DisplayName
      ServicePrincipalId          =$sp.Id
      ServicePrincipalAppId       =$sp.AppId
      GraphApplicationPermission  =$permName
    }
  }
}

"=== SERVICE PRINCIPALS WITH GRAPH APP PERMISSIONS THAT CAN GRANT APP ROLES ==="
$results |Sort-Object GraphApplicationPermission, ServicePrincipalDisplayName |Format-Table-AutoSize

Azure GUI

1

Identify service principals with Graph permissions that can grant app roles

• Go to Microsoft Entra admin center → Enterprise applications.

• Open the application (service principal).

• Go to Permissions / API permissions.

• Under Microsoft Graph → review Application permissions for:

  • AppRoleAssignment.ReadWrite.All

  • Directory.ReadWrite.All

• Record the business owner and justification.

2

Identify admin roles that can grant app roles

• Go to Roles & administrators.

• Review assignments for:

  • Global Administrator

  • Privileged Role Administrator

  • Application Administrator

  • Cloud Application Administrator

• If a group is assigned, enumerate transitive membership.

3

Review existing app role assignments

For a target enterprise app:

• Open Enterprise applications → select the app → go to Users and groups.

• Review who has roles assigned inside the application.

Exploitation

PowerShell (Microsoft Graph)

Connect-MgGraph-Scopes"AppRoleAssignment.ReadWrite.All","Application.Read.All"

$clientSpDisplayName ="Contoso-Automation"
$clientSp =Get-MgServicePrincipal-Filter"displayName eq '$clientSpDisplayName'"
if (-not$clientSp) {throw"Client service principal not found: $clientSpDisplayName" }

$graphSp =Get-MgServicePrincipal-Filter"appId eq '00000003-0000-0000-c000-000000000000'"
if (-not$graphSp) {throw"Microsoft Graph service principal not found." }

$role =$graphSp.AppRoles |Where-Object {$_.Value-eq"Group.Read.All"-and ($_.AllowedMemberTypes-contains"Application") } |Select-Object-First1
if (-not$role) {throw"App role not found: Group.Read.All" }

$params =@{
  principalId =$clientSp.Id
  resourceId  =$graphSp.Id
  appRoleId   =$role.Id
}

New-MgServicePrincipalAppRoleAssignment-ServicePrincipalId$clientSp.Id-BodyParameter$params

Write-Host"OK: Granted Microsoft Graph 'Group.Read.All' (application permission) to $($clientSp.DisplayName)."

Azure GUI

1

Open the app registration

• Go to Microsoft Entra admin center → Identity → Applications → App registrations.

• Open your app registration (Contoso-Automation).

2

Add API permission

• Select API permissions.

• Select Add a permission.

• Select Microsoft Graph.

• Select Application permissions.

3

Select permission

• Search for Group.Read.All, select it, then choose Add permissions.

4

Grant admin consent

• Back on API permissions, select Grant admin consent for , then confirm.

• Confirm Status shows Granted for Group.Read.All.

Mitigation

• Remove unnecessary Graph application permissions from service principals:

  • Prioritize removing AppRoleAssignment.ReadWrite.All and Directory.ReadWrite.All when not required.

• Restrict who can grant admin consent and who can manage enterprise applications.

• Limit privileged directory roles:

  • Keep Application Administrator and Cloud Application Administrator assignments minimal.

  • Use just-in-time access where possible.

• Implement change control for enterprise app role assignments:

  • Require approvals for role assignment changes on sensitive applications.

• Regularly review app role assignments:

  • Review both application permissions (app role assignments to Microsoft Graph) and enterprise app roles (Users and groups assignments).

Detection

Monitor Microsoft Entra Audit logs for changes related to app role assignments.

• Go to Microsoft Entra ID → Audit logs.

• Filter for application / enterprise app management activities.

• Look for events that indicate role assignment changes, such as:

  • App role assignment added

  • App role assignment granted

  • Application role assigned to user/group/service principal

• Review:

  • Initiated by (actor)

  • Target resources

  • The role / resource application involved

References

• https://learn.microsoft.com/en-us/graph/api/serviceprincipal-post-approleassignments?view=graph-rest-1.0

• https://learn.microsoft.com/en-us/graph/api/user-post-approleassignments?view=graph-rest-1.0

• https://learn.microsoft.com/en-us/graph/api/group-post-approleassignments?view=graph-rest-1.0

• https://learn.microsoft.com/en-us/graph/api/serviceprincipal-list-approleassignments?view=graph-rest-1.0

• https://learn.microsoft.com/en-us/graph/api/user-list-approleassignments?view=graph-rest-1.0

• https://learn.microsoft.com/en-us/graph/api/group-list-approleassignments?view=graph-rest-1.0

• https://learn.microsoft.com/en-us/graph/permissions-reference

• https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.applications/get-mgserviceprincipalapproleassignment?view=graph-powershell-1.0

• https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.applications/new-mgserviceprincipalapproleassignment?view=graph-powershell-1.0

• https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities