search

AZ_PRIVILEGED_ROLE_ADMIN

hashtag
Summary

FSProtect ACL Alias

AZ_PRIVILEGED_ROLE_ADMIN

Entra ID (Azure AD) Alias

Privileged Role Administrator

Affected Object Types

Directory roles, role-assignable groups, role assignments (active/eligible), PIM role settings

Exploitation Certainty

Certain

Graph Permission / Role

Membership in the Privileged Role Administrator directory role (direct assignment or via a role-assignable group). Equivalent capability can also exist through Microsoft Graph permissions that allow directory role management (for example RoleManagement.ReadWrite.Directory).

hashtag
Description

AZ_PRIVILEGED_ROLE_ADMIN represents the ability for a principal to operate as a Privileged Role Administrator in Microsoft Entra ID.

A Privileged Role Administrator can manage directory roles. This includes creating and removing role assignments. In tenants using PIM, it can manage privileged role assignment workflows and role settings.

By using this role, an attacker can:

  • Grant themselves (or a controlled identity) a privileged directory role and gain administrative access.

  • Assign privileged roles to a service principal or role-assignable group to create persistence.

  • Modify role assignment configuration and governance to reduce controls.

Therefore, any identity that holds the Privileged Role Administrator role can quickly escalate privileges by changing who has privileged roles.

hashtag
Identification

hashtag
PowerShell (Microsoft Graph)

List all members of the Privileged Role Administrator role. If a group is assigned, expand it to identify effective users.

hashtag
Azure GUI

1

hashtag
Open Roles & administrators

Open Microsoft Entra admin center → Roles & administrators and search for Privileged Role Administrator.

2

hashtag
View role assignments

Open Privileged Role Administrator and review Assignments. Record:

  • Active assignments

  • Eligible assignments (if PIM is enabled)

3

hashtag
Expand group assignments

If a group is assigned:

  • Enumerate its transitive members (include nested groups) to identify effective users.

4

hashtag
Review PIM settings

If PIM is used:

  • Review role settings, approval requirements, and activation requirements for privileged roles.

hashtag
Exploitation

A Privileged Role Administrator can change who holds privileged roles. This is a direct privilege-escalation path.

Common abuse patterns include:

  • Assigning a privileged role to a controlled user.

  • Assigning a privileged role to a controlled service principal or managed identity.

  • Assigning a privileged role to a role-assignable group and then adding members to that group.

  • Weakening role governance by changing role settings and approval requirements (in PIM-enabled tenants).

hashtag
Mitigation

  • Keep Privileged Role Administrator membership minimal.

  • Use PIM:

    • Prefer eligible assignments instead of permanent active assignments.

    • Require MFA and approvals for activation where appropriate.

  • Separate duties:

    • Do not combine role-management roles with daily operational accounts.

  • Protect role-assignable groups:

    • Strictly control membership and ownership.

    • Monitor all changes to those groups.

  • Review privileged role assignments regularly and remove unused access.

hashtag
Detection

Monitor Entra Audit logs for role management actions.

Alert on:

  • New assignments or activations of Privileged Role Administrator.

  • Any creation of role assignments for high-privilege roles.

  • Role assignment changes performed by service principals.

  • Changes to privileged role settings (in PIM environments).

When investigating, collect:

  • Initiated by (actor)

  • Target resources

  • Role name, assignment type (active/eligible), and scope

hashtag
References

PreviousAZ_PRIVILEGED_AUTH_ADMINNextAZ_RESET_PASSWORD

Last updated

Was this helpful?