> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/azure/az_runs_as.md).

# AZ\_RUNS\_AS

## Summary

|                               |                                       |
| ----------------------------- | ------------------------------------- |
| **FSProtect ACL Alias**       | AZ\_RUNS\_AS                          |
| **Entra ID (Azure AD) Alias** | Runs As                               |
| **Affected Object Types**     | App Registration -> Service Principal |
| **Exploitation Certainty**    | Certain                               |

## Description

`AZ_RUNS_AS` represents the relationship where an Azure App Registration authenticates to the tenant using its associated Service Principal.

When an App Registration needs to authenticate to Microsoft Entra ID, it does so through its Service Principal. If you have control of an App Registration, you are effectively abusing that control plus the privileges assigned to the Service Principal it runs as.

This edge is critical for privilege escalation because:

* Controlling an App allows you to add credentials (secrets/certificates) to authenticate as its Service Principal.
* The Service Principal may have dangerous permissions (API permissions, Azure RBAC roles, or Entra directory roles).
* Apps often have more permissions than necessary due to over-provisioning.

## Identification

### PowerShell (Microsoft Graph)

List all App Registrations and their associated Service Principals:

```powershell
Connect-MgGraph -Scopes "Application.Read.All"
Get-MgApplication -All | ForEach-Object {
    $sp = Get-MgServicePrincipal -Filter "appId eq '$($_.AppId)'" -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        AppName = $_.DisplayName
        AppId = $_.AppId
        AppObjectId = $_.Id
        SPObjectId = $sp.Id
        SPDisplayName = $sp.DisplayName
    }
} | Format-Table -AutoSize
```

### Azure Portal

1. Open **Microsoft Entra admin center** -> **App registrations**.
2. Select an application.
3. Note the **Application (client) ID**.
4. Navigate to **Enterprise applications** and search by the same App ID to find the Service Principal.

## Exploitation

This edge should be taken into consideration when abusing control of an App. Apps authenticate with Service Principals to the tenant, so if you have control of an App, what you are abusing is that control plus the fact that the App runs as a privileged Service Principal.

To abuse this relationship, you need control over the App Registration through another edge (e.g., [AZ\_ADD\_SECRET](https://docs.forestall.io/fsprotect/edges/azure/az_add_secret), [AZ\_ADD\_OWNER](https://docs.forestall.io/fsprotect/edges/azure/az_add_owner), [AZ\_APP\_ADMIN](https://docs.forestall.io/fsprotect/edges/azure/az_app_admin)). Once you have that control, you can add credentials to the App and authenticate as the Service Principal it runs as.

## Mitigation

* Limit who can add credentials to App Registrations.
* Use certificate-based authentication instead of secrets where possible.
* Apply least-privilege to Service Principals.
* Regularly review and rotate App credentials.
* Monitor for unexpected credential additions.

## Detection

Use the Microsoft Entra admin center:

1. Open **Microsoft Entra ID** -> **Audit logs**.
2. Filter **Activity** for application or service principal credential changes.
3. Review **Initiated by (actor)**, **Target**, **Date**, and **Status** for unexpected credential additions.
4. Open **Sign-in logs** and filter for the affected service principal.
5. Review **Service principal**, **Resource**, **IP address**, **Location**, **Date**, and **Status** for unexpected sign-in activity.

## References

* <https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals>
* <https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal>
* <https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-audit-logs>