Attackers Exploit Microsoft Entra Billing Role Exploit Enables Privilege Escalation in Organizations

A privilege-escalation vulnerability involving Microsoft Entra’s Billing Administrator role allows attackers who compromise billing-role accounts (commonly via social engineering or credential theft) to reassign directory roles — potentially achieving Global Administrator — and thus gain broad control over identity, application, and data resources; Microsoft has acknowledged the risk and advised reviewing and restricting Billing Administrator assignments, auditing Entra ID permissions, and monitoring for anomalous role changes.