Understanding how roles work in Entra ID is of crucial importance in a context where cybersecurity and operational efficiency are paramount. These roles define the responsibilities and permissions assigned to users, allowing them to manage identities, access to resources, and regulatory compliance. In this article, we'll explore the available roles, their core functions, and best practices for using them effectively in the company.
In cybersecurity, the principle of least privilege is a fundamental pillar, which promotes the minimum access necessary for users to perform their functions.
However, in complex IT environments, some roles require elevated privileges to effectively manage and maintain systems.
The directors of Entra ID are well aware of the risks associated with user accounts that hold the 'keys to the kingdom', such as when they are assigned to the role of Global Administrator or other service administrator roles.
It is equally important to remember that applications and users delegated to manage them are also at risk and must be carefully protected.
Among the privileged roles within Microsoft Entra are the role of Application Administrator, that of Cloud Application Administrator, and the role of Owner.
These roles at Microsoft Entra confer significant power and, as a result, involve high risks. It is crucial to manage and oversee these roles with the utmost care.
So let's examine what roles are and how the incorrect management of administrative roles can make them the focal point of attacks aimed at stealing credentials. Control over them can ensure unlimited access to sensitive data and critical systems.
Excessively privileged access can pose a significant risk to Microsoft Entra Enterprise Apps and your organization's data. Microsoft Entra roles that grant administrative access involve great responsibility and risk.
The risks associated with administrative access are multiple. Administrators with elevated privileges can make system-level changes, install software, and access sensitive data.
When users are granted more privileges than necessary, although useful for maintenance and management, a condition known as “excessive privilege access” is created, which represents a significant risk for organizations because it opens up several security vulnerabilities.
This excess of privilege can be exploited by malicious actors or lead to unintentional internal threats. Risks associated with over-privileged access include unauthorized access to data, data manipulation, and potential extensive system disruptions.
A recent guide on Microsoft Entra security operations for applications highlights the importance of monitoring application events to prevent breaches. The guide highlights that, although applications are not as often targeted as user accounts, they have an attack surface that must be carefully monitored.
Continuous monitoring and the activation of alerts on application events is recommended to prevent malicious applications from gaining access to unauthorized data and to protect them from compromise by malicious actors.
Another aspect of the risk is privilege escalation, in which attackers abuse highly privileged application registrations to quickly switch from lower-level accounts to global administrator accounts. This type of attack can be particularly damaging, as it allows for quick and extensive access to an organization's IT environment.
Attackers have exploited registrations of highly privileged applications to achieve an escalation of privileges within an organization's IT environment. By moving from a lower-level account to a global administrator account, they gained extensive access to sensitive data and systems.
It is for these reasons and many, many others that it is necessary to thoroughly understand what roles are, how to assign them correctly and how they operate within the Entra ID security infrastructure. And in the next few sections, we'll try to do exactly that.
We have created the Infrastructure & Security team, focused on the Azure cloud, to better respond to the needs of our customers who involve us in technical and strategic decisions. In addition to configuring and managing the tenant, we also take care of:
With Dev4Side, you have a reliable partner that supports you across the entire Microsoft application ecosystem.
So, what exactly is a role? It is nothing more than a collection of permissions. A role lists the operations that can be performed on Microsoft Sign In resources, such as creating, reading, updating, and deleting.
At the moment, there are about 80 predefined (but constantly increasing) roles in Microsoft Entra, which are roles with a fixed set of permissions.
To integrate the predefined roles, Microsoft Entra ID also supports the addition of custom roles by administrators for special needs; however, they require an Entra ID P1 or P2 license.
You can use custom roles to select the role permissions you want and they are currently limited to 500 per tenant.
Granting permissions using Microsoft Entra custom roles is a two-step process:
A custom role definition is a collection of permissions that you can add from a predefined list. These permissions are the same as those used in the default roles.
Once you have created a custom role definition (or used a predefined role), you can assign it to a user by creating a new role assignment.
A role assignment grants the user the permissions contained in a role definition for a specific scope. This two-step process allows you to create a single role definition and assign it multiple times to different scopes.
A scope defines the set of Microsoft Sign In resources that the role member has access to.
The most common scope is the organization-wide scope (org-wide), which assigns role permissions on all of the organization's resources. A custom role can also be assigned at the object scope level. An example of an object scope could be a single application.
A role assignment is a Microsoft Entra resource that links a role definition to a security principal in a specific scope to grant access to Microsoft Entra resources. Access is granted by creating a role assignment and revoked by removing it.
Basically, a role assignment consists of three elements:
You can create and view role assignments using the Microsoft Entra admin center, Microsoft Graph PowerShell, Microsoft Graph API and Azure CLI.
Microsoft Entra ID offers several options for assigning roles:
Understanding the capabilities and potential impact of each administrative role is critical. Authorizations with the label PRIVILEGED help identify permissions that can elevate privileges if not used in an intended and secure manner.
What are some of these privileged roles in Microsoft Entra IDs related to Enterprise Applications and App Registrations?
If you log in to the Admin Center of Sign In and proceed on Identity > Roles and Admins, it is possible to filter the roles by service (in this case, 'Applications') and obtain a filtered list of the roles applicable to the applications. After filtering the view, you will get a list of roles, some of which are privileged.
Let's now give a brief overview of the main administrative roles to understand how they work.
The first built-in role on the list is the role of Application Administrator. This role is typically responsible for managing user access, configuring application settings, and ensuring the availability and security of the application.
This is a directory-level role that has inherited access to All enterprise apps and app registrations and can only be assigned at the directory level.
This role is privileged and can grant consent for delegated permissions and application permissions, with the exception of application permissions related to tenant-level graph permissions, which require a more privileged role, such as the Global Administrator.
The Application Administrator role can add credentials to an application, allowing you to impersonate the identity of the application.
If an application has privileged abilities, a user assigned to the Application Administrator role could impersonate it and perform elevated actions, such as creating or updating users or other objects.
After last year's updates, the role can also manage access certifications to the apps it has access to, a very important feature for governance operations.
Next we find the role of Application Developer. Users with the role of Application Developer can create and manage application registrations themselves. This access includes configuring authentication methods, permissions, and other application settings.
The Application Developer role is also a directory-level role.
Application Developers can register web APIs, mobile applications, single-page applications (SPA), and more.
Application Developers assign permissions to applications. These permissions determine which resources (such as APIs, user data, or other services) an application can access.
They can grant delegated permissions (acting on behalf of users) or Application permissions (acting independently). Users with this role can provide consent to app permissions for themselves or on behalf of others.
They can manage Client Secrets associated with app registrations. However, the Application Developer cannot make some changes to Enterprise Applications, as these require elevated permissions that the role does not have.
The role of Cloud Application Administrator It is similar to the role of Application Administrator, but with a focus on cloud-based services. This role focuses solely on managing applications hosted in the cloud and does not include the ability to manage the application proxy.
This role allows you to create and manage all aspects of enterprise applications and app registrations. It can be assigned both at the directory level and at the individual application level.
The role of Owner often holds the highest level of privileges. Owners can make crucial decisions about application configuration, user roles, and data management policies. The owner role has the same privileges as Application Administrators, but it's limited to a specific application.
Users are automatically assigned as owners when they add a new enterprise application. As the owner, they have the ability to manage the specific configuration of the application's tenant, including the settings of Single Sign-On (SSO), user provisioning and assignment.
Owners can also add or remove other owners. Unlike who plays the role of Application Administrator, owners can only manage the applications they own.
Currently, only individual users are supported as application owners. Assigning groups as owners is not yet supported.
To list all the Enterprise applications for which a user is delegated as the owner in Microsoft Entra ID, just follow these steps:
This will show a list of the applications associated with the specified owner. These are the built-in roles; it is possible to create Custom Roles and assign these roles to users, however, care must be taken, since privileged permissions can be inadvertently assigned to a custom role creating possible flaws in the security of their systems.
Now that we know better the roles and their tasks within digital security infrastructures, the time has come to understand how to best use them.
To mitigate the risks associated with administrative privileges, Admins Entra ID should implement the following best practices:
Understanding how your Cybersecurity tools work and the principles on which they are based is essential to be able to guarantee your company the best possible security posture in an era where cybersecurity threats are more severe than ever.
By understanding the roles that underlie Entra ID's access policies and implementing best practices for managing privileged access, organizations can protect their systems from the inherent dangers of elevated privileges.
It's a delicate balance between empowering those who maintain our systems and protecting the integrity and security of our digital assets. A balance that must be learned to know and respect if you do not want to lose your reputation as well as your time and money.
The Entra ID Roles are administrative roles in Microsoft Entra ID that determine the permissions and operations that a user can perform on the organization's resources. They are used to securely manage access and ensure compliance with company policies.
These roles make it possible to limit user access to only the necessary resources, reducing the risk of unauthorized access and cyberattacks. By applying the principle of least privilege, users with excessive privileges are prevented from becoming targets for privilege escalation or data breaches.
Among the most relevant roles are the Application Administrator, who manages access and settings of business applications, the Cloud Application Administrator, who deals exclusively with cloud applications, the Application Developer, who can create and configure new registered apps, and the Owner, who has the highest level of control over a specific application.
Users with advanced administrative roles can access sensitive data, modify system configurations, and install software, making these accounts the target of targeted attacks. Excessively privileged access can lead to privilege escalation, information manipulation, and service interruptions. Applications must also be closely monitored, because they can be exploited as attack vectors.
Roles can be assigned directly to a user or to a group, simplifying access management. With Entra ID P2, Privileged Identity Management can be used to grant temporary access to roles, improving control over users with elevated privileges.
Custom Roles are custom roles created to meet specific organization needs. They allow you to assign selected permissions instead of using only those predefined by Microsoft. An Entra ID P1 or P2 license is required to create and use Custom Roles.
To ensure secure management, it is essential to perform periodic audits to verify that users have adequate privileges, activate multi-factor authentication for all administrative accounts, and adopt the principle of least privilege to limit access only to operations that are strictly necessary. It is equally important to monitor access and activate notifications to detect suspicious activity, as well as to segment administrative roles to prevent a compromise from having an impact on the entire infrastructure.
Yes, administrators can manage, modify, or remove an assigned role using the Microsoft Entra admin center, Microsoft Graph PowerShell, Microsoft Graph API, or Azure CLI.
The Application Administrator has complete control over business applications and is able to manage multiple applications, while an Owner has the same privileges but is limited to a single specific application.
Microsoft Entra provides advanced tools such as Privileged Identity Management to assign roles temporarily, Administrative Units to segment roles in large organizations, and monitoring logs to track all the activities of users with administrative privileges.
To verify which roles have been assigned to a user, you can log in to the Microsoft Login admin center and navigate to the Identity > Roles and Admins section. Alternatively, you can use Microsoft Graph PowerShell or Azure CLI to obtain the information via the command line.
Microsoft Entra ID currently offers around 80 predefined roles, but the number is constantly growing to adapt to new security and management needs.
Yes, assigning a role to a group simplifies access management and ensures that all members of the group have the same permissions. This functionality is available with Entra ID P1 and E3/E5.
If an account with elevated privileges is breached, an attacker could gain access to critical information, change business configurations, or even interrupt IT services. To mitigate this risk, it's essential to enable multi-factor authentication, limit the use of administrative accounts, and constantly monitor suspicious activity.
The Infra & Security team focuses on the management and evolution of our customers' Microsoft Azure tenants. Besides configuring and managing these tenants, the team is responsible for creating application deployments through DevOps pipelines. It also monitors and manages all security aspects of the tenants and supports Security Operations Centers (SOC).
