> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/azure/az_mg_groupmember_readwrite_all.md).

# AZ\_MG\_GROUPMEMBER\_READWRITE\_ALL

## Summary

|                               |                                                   |
| ----------------------------- | ------------------------------------------------- |
| **FSProtect ACL Alias**       | AZ\_MG\_GROUPMEMBER\_READWRITE\_ALL               |
| **Entra ID (Azure AD) Alias** | GroupMember.ReadWrite.All                         |
| **Affected Object Types**     | Service Principals, Applications                  |
| **Exploitation Certainty**    | Certain                                           |
| **Graph Permission / Role**   | Application Permission: GroupMember.ReadWrite.All |

## Description

`AZ_MG_GROUPMEMBER_READWRITE_ALL` grants **read and write access to group memberships** in Microsoft Entra ID.

**Capabilities:**

* **Add/remove members** to security groups and Microsoft 365 groups
* **Read group memberships** and properties

**Limitations:**

* **Cannot modify role-assignable groups** (requires `RoleManagement.ReadWrite.Directory`)
* **Cannot create/delete groups** (requires `Group.ReadWrite.All`)

**Abuse scenarios:**

* **Lateral movement**: Add accounts to groups with Azure RBAC or application access
* **Defense evasion**: Remove security team members from monitoring groups

## Identification

### PowerShell (Microsoft Graph)

```powershell
Connect-MgGraph -Scopes "Application.Read.All"

$permissionId = "dbaae8cf-10b5-4b86-a4a1-f871c94c6695"  # GroupMember.ReadWrite.All
$graphSp = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"

Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $graphSp.Id -All | Where-Object { $_.AppRoleId -eq $permissionId } | ForEach-Object {
    $sp = Get-MgServicePrincipal -ServicePrincipalId $_.PrincipalId
    [PSCustomObject]@{ DisplayName = $sp.DisplayName; AppId = $sp.AppId }
} | Format-Table -AutoSize
```

### Azure GUI

1. **Microsoft Entra admin center** -> **Applications** -> **Enterprise applications**
2. Select application -> **Permissions** -> Look for **GroupMember.ReadWrite.All**

## Exploitation

An attacker with `GroupMember.ReadWrite.All` can add accounts to normal security groups (not role-assignable groups).

For exploitation details, see [AZ\_MG\_ADD\_MEMBER](https://docs.forestall.io/fsprotect/edges/azure/az_mg_add_member).

## Mitigation

* **Audit and remove** unnecessary `GroupMember.ReadWrite.All` grants
* **Apply least privilege**: Use `GroupMember.Read.All` if only read access is needed
* **Regular access reviews** for applications with this permission

## Detection

### PowerShell (Microsoft Graph)

```powershell
Connect-MgGraph -Scopes "AuditLog.Read.All"

Get-MgAuditLogDirectoryAudit -Filter "activityDisplayName eq 'Add member to group' or activityDisplayName eq 'Remove member from group'" -Top 50 | ForEach-Object {
    [PSCustomObject]@{
        DateTime = $_.ActivityDateTime
        Activity = $_.ActivityDisplayName
        Actor    = $_.InitiatedBy.App.DisplayName ?? $_.InitiatedBy.User.UserPrincipalName
        Target   = $_.TargetResources[0].DisplayName
    }
} | Format-Table -AutoSize
```

### Azure GUI

* **Microsoft Entra ID** -> **Audit logs** -> Filter: **Add member to group** / **Remove member from group**

## References

* <https://learn.microsoft.com/en-us/graph/permissions-reference>
* <https://learn.microsoft.com/en-us/graph/api/group-post-members>
* <https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/groups-concept>