BadZure lab: group-indirection.yml

Lab description

This lab contains 0 Azure resource(s), 3 assignment(s), and 1 enabled attack path(s).

Organization

The organization contains 1 user(s), 1 group(s), 1 service principal(s), and 0 administrative unit(s).

Identity Plane

1Users

1Groups

1Service principals

0Administrative units

3Assignments

Users (1)

Object	Properties
robin	display name: Robin mail nickname: robin user principal name: robin

Groups (1)

Object	Properties
app-operators	display name: app-operators

Applications (1)

Object	Properties
role-manager-app	display name: role-manager-app

Administrative Units (0)

None

Assignments(3)

Type	Source	Target	Properties
MEMBER_OF	robin	app-operators	key: group_member_to_app_admin__a1 origin: attack_path
ASSIGNED_ENTRA_ROLE	app-operators	Application Administrator	key: group_member_to_app_admin__a2 origin: attack_path role: Application Administrator
ASSIGNED_ENTRA_ROLE	role-manager-app	Global Administrator	key: group_member_to_app_admin__a3 origin: attack_path role: Global Administrator

Cloud Plane

0Resource groups

0Azure resources

0Regions

1Attack paths

Resource Groups (0)

None

Key Vaults (0)

None

Storage Accounts (0)

None

Virtual Machines (0)

None

Logic Apps (0)

None

Automation Accounts (0)

None

Function Apps (0)

None

App Services (0)

None

Cosmos Dbs (0)

None

Attack paths

Global Administrator via a group's role

reached

A user inherits Application Administrator through group membership, takes over an app holding a privileged Graph permission, and escalates to Global Administrator.

controlled principal 'role-manager-app' holds the target Entra role.

MITRE: T1078.004, T1098.003, T1098.001.

Ordered narrative (4 steps)

Compromise robin
Inherit access via group membership → app-operators
Traverse to → role-manager-app
Achieve objective: Global Administrator

Identity / Organization

High-level Entra identity inventory with user, application service-principal, and managed-identity summaries, group structure, and administrative-unit membership counts.

AdministrativeUnitCatalog Group IdentityCategory IdentitySummary Organization SecurityPrincipalCatalog CONTAINS IDENTITY HAS ADMINISTRATIVE UNITS HAS IDENTITY CATEGORY HAS PRINCIPAL CATALOG SUMMARIZES

Azure Resources

Subscription and resource-group placement with visible inventory totals, resources grouped by type, and missing placement called out explicitly.

Subscription

Assignments

Generated assignment families, roles and permissions, summarized by principal type. Select an aggregate for counts and underlying references.

AssignmentCatalog AssignmentFamily PrincipalSummary Relationship Role ASSIGNED TO CONTAINS FAMILY CONTAINS KIND

Posture: group_member_to_app_admin

Legitimate configuration relationships that make this path possible.

Credential EntraRole Group Objective ServicePrincipal User CAN MANAGE HAS CREDENTIAL HAS ENTRA ROLE MEMBER OF SATISFIES OBJECTIVE

Attack: group_member_to_app_admin

Ordered attacker actions from initial access to the path objective.

Attacker Credential Identity Objective ACHIEVES ADDS APP CREDENTIAL AUTHENTICATES AS COMPROMISES INHERITS ACCESS