Search for Microsoft security blog posts written and shared by the community. Discover insights on Azure, Defender, Entra, Intune, Sentinel, and more.

Escalating Privileges as a Catalog Owner: How Microsoft Entra Identity Governance’s API Permission Management Could Be Abused

by Thomas Naunheim (thomas@naunheim.net)
azure-ad microsoft-entra azuread identity-governance privileged-access
This post examines a gap in Microsoft Entra Identity Governance that allowed a catalog owner without separate resource-owner authorization to grant Microsoft Graph API permissions to a service prin...
Read full article →