Escalating Privileges as a Catalog Owner: How Microsoft Entra Identity Governance’s API Permission Management Could Be Abused

This post examines a gap in Microsoft Entra Identity Governance that allowed a catalog owner without separate resource-owner authorization to grant Microsoft Graph API permissions…

A short excerpt. Read the linked source for the full article and context.

• Application AdministratorExplicit name or template GUID in this notice
• Attribute Log ReaderExplicit name or template GUID in this notice
• Authentication AdministratorExplicit name or template GUID in this notice
• Global AdministratorExplicit name or template GUID in this notice
• Helpdesk AdministratorExplicit name or template GUID in this notice
• Identity Governance AdministratorExplicit name or template GUID in this notice
• Intune AdministratorExplicit name or template GUID in this notice
• Privileged Role AdministratorExplicit name or template GUID in this notice

Links open the current public role definition. A mention does not establish tenant impact, assignment, or historical permissions.

Monitored guidance in the same product area; this does not establish that the article cites each page.

• Entra dynamic membership rules and the memberOf operator
• Dynamic membership for administrative units
• Create simpler, more efficient dynamic membership rules
• Configure dynamic membership with the memberOf operator
• Understand and manage dynamic group processing