> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/azure/parent_tenant.md).

# PARENT\_TENANT

## Summary

|                            |                                                                                |
| -------------------------- | ------------------------------------------------------------------------------ |
| **FSProtect ACL Alias**    | PARENT\_TENANT                                                                 |
| **Azure Alias**            | Tenant Contains                                                                |
| **Affected Object Types**  | Users, Groups, Applications, Service Principals, Devices, Roles, Subscriptions |
| **Exploitation Certainty** | Informational                                                                  |

## Description

`PARENT_TENANT` is the structural/containment edge from a Microsoft Entra ID Tenant to its child objects. It represents that **Tenant contains Entity**, with the edge pointing from the tenant to the child.

| Parent     | Children                                                                                                        |
| ---------- | --------------------------------------------------------------------------------------------------------------- |
| **Tenant** | Users, Groups, Applications, Service Principals, Devices, Roles, Subscriptions, and other tenant-scoped objects |

This edge is not directly exploitable. It shows tenancy and how directory roles and permissions are scoped within the tenant boundary.

Related edges: [AZ\_PARENT](https://docs.forestall.io/fsprotect/edges/azure/az_parent).

## Identification

Use the Azure Portal and Microsoft Entra admin center:

1. Open **Microsoft Entra ID** -> **Overview** to see the tenant and its scoped identity objects.
2. Open **Microsoft Entra ID** -> **Users** for tenant users.
3. Open **Microsoft Entra ID** -> **Groups** for tenant groups.
4. Open **Microsoft Entra ID** -> **App registrations** for tenant applications.
5. Open **Microsoft Entra ID** -> **Enterprise applications** for tenant service principals.
6. Open **Microsoft Entra ID** -> **Devices** for tenant devices.
7. Open **Azure Portal** -> **Subscriptions** for subscriptions associated with the tenant.

## Exploitation

There is no direct exploit for this edge. It represents a containment relationship.

Tenant-level privileged roles (Global Administrator, Privileged Role Administrator, etc.) have full control over all child entities within the tenant.

## References

* <https://learn.microsoft.com/en-us/entra/fundamentals/whatis>
* <https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference>
* <https://learn.microsoft.com/en-us/entra/fundamentals/concept-learn-about-groups>