Azure Privilege Escalation via Service Principal Abuse

The report details an Azure AD privilege-escalation technique where users with roles such as Application Administrator can add credentials to service principals that hold high-privilege roles (e.g., Privileged Role Administrator or Global Administrator), enabling escalation to tenant-wide admin rights. It contrasts Azure’s built‑in password reset protections for Global Admin users with the lack of equivalent safeguards for service principals, maps the attack path, and recommends mitigations: auditing and minimizing privileged roles on service principals, reviewing app owners and app-scoped role assignments, and limiting who can manage application credentials. It also advocates for Microsoft to extend its safety mechanisms to protect privileged service principals.