{"id":4455,"date":"2025-08-10T15:17:37","date_gmt":"2025-08-10T19:17:37","guid":{"rendered":"https:\/\/adsecurity.org\/?p=4455"},"modified":"2025-08-18T22:28:00","modified_gmt":"2025-08-19T02:28:00","slug":"entra-azure-revisited","status":"publish","type":"post","link":"https:\/\/adsecurity.org\/?p=4455","title":{"rendered":"Entra & Azure Elevated Access Revisited"},"content":{"rendered":"\n

In early 2020, I published an article<\/a> on how a Global Administrator could gain control of Azure resources, that no one would know about it, and how this access would persist even after removing them from Global Administrator.<\/p>\n\n\n\n

From that article:<\/p>\n\n\n\n

\u201cWhile Azure leverages Azure Active Directory for some things, Azure AD roles don\u2019t directly affect Azure (or Azure RBAC) typically. This article details a known configuration (at least to those who have dug into Azure AD configuration options) where it\u2019s possible for a Global Administrator (aka Company Administrator) in Azure Active Directory to gain control of Azure through a tenant option. This is \u201cby design\u201d as a \u201cbreak-glass\u201d (emergency) option that can be used to (re)gain Azure admin rights if such access is lost. In this post I explore the danger associated with this option how it is currently configured (as of May 2020). The key takeaway here is that if you don\u2019t carefully protect and control Global Administrator role membership and associated accounts, you could lose positive control of systems hosted in all Azure subscriptions as well as Office 365 service data.\u201d<\/em><\/p>\n\n\n\n

Elevated Access<\/strong><\/p>\n\n\n\n

There is a switch that can be flipped from \u201cNo\u201d to \u201cYes\u201d that allows a Global Administrator to gain \u201cmanage access to all Azure subscriptions and management groups in this directory\u201d. Flipping this switch to Yes adds the current user to the Azure role User Access Administrator at the root level. Once this access is provided, the current user can then add themself to other roles like Subscription Admin.
The graphic below shows this flow.<\/p>\n\n\n\n\n\n\n\n

\"\"<\/figure>\n\n\n\n


This leads to some interesting attack scenarios. The one I covered in the article involved jumping to Azure and compromising an Azure hosted Domain Controller. The graphic below shows the conceptual attack scenario laid out in the article.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Attack Scenario Key Takeaways<\/strong><\/p>\n\n\n\n