Hazy Issue in Entra ID Allows Privileged Users to Become Global Admins

A Black Hat presentation disclosed that Microsoft Entra ID has a weakness where privileged Application or Cloud Application Administrator roles can assign credentials to service principals and then use OAuth client credential flows to act as those applications; certain Microsoft service principals (Viva Engage, Rights Management Service, Device Registration Service) were found to have excessive capabilities, including a path to Global Administrator escalation. Microsoft rated the issues, applied mitigations to limit credential use on service principals, and advised organizations to audit Entra ID logs and application admin practices, though exploitation in the wild is unconfirmed.