> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/azure/parent_tenant.md).

# PARENT\_TENANT

## Summary

|                            |                |
| -------------------------- | -------------- |
| **FSProtect ACL Alias**    | PARENT\_TENANT |
| **Affected Object Types**  | All Objects    |
| **Exploitation Certainty** | Unlikely       |

## Description

`PARENT_TENANT` represents that an object (user, group, application, service principal, device, etc.) belongs to a specific Microsoft Entra ID tenant. This edge shows the relationship where **Object X belongs to Tenant Y**.

The tenant serves as the organizational boundary containing all identity objects. Every user, group, application, and service principal exists within exactly one tenant.

However, the `PARENT_TENANT` relationship itself does not represent a direct exploitable permission. It indicates which tenant an object belongs to for understanding scope of permissions and administrative control.

## Identification

You can identify objects and their parent tenant with these scripts:

```powershell
Import-Module Microsoft.Graph.Users
Import-Module Microsoft.Graph.Groups
Import-Module Microsoft.Graph.Applications

Connect-MgGraph -Scopes "User.Read.All", "Group.Read.All", "Application.Read.All"

$tenantId = (Get-MgContext).TenantId

# Get all users and their parent tenant
Get-MgUser -All | Select-Object DisplayName, Id, @{N='ParentTenantId';E={$tenantId}} | Format-Table -AutoSize

# Get all groups and their parent tenant
Get-MgGroup -All | Select-Object DisplayName, Id, @{N='ParentTenantId';E={$tenantId}} | Format-Table -AutoSize

# Get all applications and their parent tenant
Get-MgApplication -All | Select-Object DisplayName, Id, @{N='ParentTenantId';E={$tenantId}} | Format-Table -AutoSize

# Get all service principals and their parent tenant
Get-MgServicePrincipal -All | Select-Object DisplayName, Id, @{N='ParentTenantId';E={$tenantId}} | Format-Table -AutoSize
```

## Exploitation

There is no practical exploit path for this edge. It indicates which tenant an object belongs to but does not allow creation, modification, or deletion of any objects.

## Mitigation

No specific mitigation is required, as this edge does not represent a vulnerability.

## Detection

This edge represents a static relationship (object membership in a tenant). Objects cannot be moved between tenants, so there are no specific detection requirements.

## References

* <https://learn.microsoft.com/en-us/powershell/module/az.accounts/get-aztenant>
* <https://learn.microsoft.com/en-us/entra/fundamentals/whatis>