AZ_SECURITY_ADMIN

Summary

FSProtect ACL Alias	AZ_SECURITY_ADMIN
Entra ID (Azure AD) Alias	Security Administrator
Affected Object Types	Tenant security configuration (Microsoft Entra ID security settings, security alerts/incidents, Microsoft Defender portals and integrated security controls depending on licensing)
Exploitation Certainty	Certain
Graph Permission / Role	Membership in the Security Administrator directory role (direct assignment or via a role-assignable group). Related Microsoft Graph permissions can also provide partial security-management capability depending on the API and product integration.

---

Description

AZ_SECURITY_ADMIN represents the ability for a principal to operate as a Security Administrator in Microsoft Entra ID.

A Security Administrator can manage security-related configuration and operational security workflows. Depending on tenant configuration and product usage, this role can:

• Manage security policies and security settings within Entra and integrated Microsoft security services.

• View and manage security alerts and incidents.

• Configure and manage security notifications and operational responses.

By abusing security administration capability, an attacker can:

• Weaken security controls and reduce detection coverage.

• Hide or suppress alerts and operational signals.

• Change security configuration to enable further privilege escalation or persistence.

Therefore, any identity that holds the Security Administrator role can expand access and reduce defenses by modifying security configuration and security operations.

---

Identification

PowerShell (Microsoft Graph)

List all members of the Security Administrator role. If a group is assigned, expand it to identify effective users.

Get-SecurityAdministratorMembers.ps1

Connect-MgGraph -Scopes "RoleManagement.Read.Directory","Directory.Read.All"

$roleDefinitionId = "194ae4cb-b126-40b2-bd5b-6091b380977d"
$uri = "/v1.0/roleManagement/directory/roleAssignments?`$filter=roleDefinitionId eq '$roleDefinitionId'&`$expand=principal"

$r = Invoke-MgGraphRequest -Method GET -Uri $uri

$r.value | ForEach-Object {
  $p = $_.principal
  [PSCustomObject]@{
    PrincipalType     = $p.'@odata.type'
    DisplayName       = $p.displayName
    UserPrincipalName = $p.userPrincipalName
    AppId             = $p.appId
    ObjectId          = $_.principalId
    DirectoryScopeId  = $_.directoryScopeId
  }
} | Format-Table -AutoSize

Azure GUI

1

Open Roles & administrators

Open Microsoft Entra admin center → Roles & administrators.

2

Find Security Administrator

Search and open Security Administrator.

3

Review assignments

Open Assignments and record:

• Active assignments

• Eligible assignments (if PIM is enabled)

4

Expand group assignments

If a group is assigned:

• Enumerate its transitive members (nested included).

5

Assess usage

Identify whether the role is used for daily operations or only for incident response.

---

Exploitation

A Security Administrator can reduce detection and weaken defensive controls. This is a high-impact role for security posture.

Common abuse patterns include:

• Modifying security settings and policies to reduce enforcement.

• Reducing alert visibility or changing incident/alert handling workflows.

• Using security management access to delay or disable responses during an attack.

---

Mitigation

• Keep Security Administrator assignments minimal.

• Use PIM:

  • Prefer eligible assignments.

  • Require MFA and approvals for activation where appropriate.

• Separate duties:

  • Use dedicated security operations accounts.

  • Do not use the role for normal user accounts.

• Require change control for security configuration changes.

• Review membership regularly and remove unused access.

---

Detection

Monitor Entra Audit logs for role changes and security configuration activity.

• Alert on:

  • New assignments or activations of Security Administrator.

  • Unusual security configuration changes.

  • Role changes outside change windows.

• Investigate:

  • Initiated by (actor)

  • Target resources

  • Change correlation (tickets, incident IDs)

---

References

Documentation links

• https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference

• https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/directory-roles-overview

• https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities

• https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-audit-logs