azrte-marcgoam

[marcgoam]

Summary

Adds a new privilege escalation technique to the EntraID privesc page, covering microsoft.directory/applications.myOrganization/allProperties/update.

This permission is not present in any built-in role but commonly appears in custom roles delegated to application teams under the assumption that the .myOrganization subtype scopes the action to internal-only apps. Since allProperties includes passwordCredentials and keyCredentials, the permission is functionally equivalent to credential-injection capability against every single-tenant app in the tenant.

Why this matters

The existing page already documents applications/credentials/update. The new section complements it by surfacing the custom-role-scoped variant, which is underdocumented and easy to miss during privileged-role audits, admins filter on built-in privileged roles and miss custom roles carrying this single action.

Testing

The full attack chain was reproduced end-to-end in an isolated Microsoft 365 Business Premium trial tenant:

  1. Created a custom role with `applications.myOrganization/allProperties/update` as the only action.
  2. Assigned it to a non-privileged victim user.
  3. From the victim's session, ran the documented commands to inject a credential into a target single-tenant app and successfully authenticated as the application via `az login --service-principal`.

References

• https://learn.microsoft.com/entra/identity/role-based-access-control/custom-available-permissions
• https://learn.microsoft.com/entra/identity/role-based-access-control/permissions-reference
• https://learn.microsoft.com/graph/api/application-addpassword