Skip to main content
Applies to BloodHound Enterprise and CE It is created against all Entra ID admin roles when a Service Principal has the following MS Graph app role assignment:
  • RoleManagement.ReadWrite.Directory
This privilege allows the Service Principal to promote itself or any other principal to any Entra ID admin role, including Global Administrator.

​
Abuse Info

To abuse this privilege, you can promote a principal you control to Global Administrator using BARK’s New-EntraRoleAssignment. This function requires you to supply an MS Graph-scoped JWT associated with the Service Principal that has the privilege to grant Entra ID admin roles. There are several ways to acquire a JWT. For example, you may use BARK’s Get-MSGraphTokenWithClientCredentials to acquire an MS Graph-scoped JWT by supplying a Service Principal Client ID and secret:
Then use BARK’s New-EntraRoleAssignment function to grant the Entra ID role to your target principal:
If successful, the output will include the principal ID, the role ID, and a unique ID for the role assignment.

​
Opsec Considerations

When you assign an Entra ID admin role to a principal using this privilege, the Azure Audit log will create an event called “Add member to role outside of PIM (permanent)”.

​
References