azure-b2c-user-admin-reset-password
User Administrator role in B2C tenant can reset B2C consumer account passwords, enabling account takeover.
match (effective permission)
{
"action": "microsoft.directory/users/password/update",
"api": "MS Graph POST /beta/users/{id}/resetPassword OR /beta/users/{id}/revokeSignInSessions"
}
where
principal holds 'User Administrator' directory role inside the B2C tenant
emit
| source type | Identity |
|---|---|
| target type | HumanIdentity |
| source | <principal> |
| target | <B2C consumer user account (HumanIdentity)> |
| permissions | microsoft.directory/users/password/update UserAuthenticationMethod.ReadWrite.All |
| conditions | iam_permission |
| state logic | ACTIVE when the principal holds the User Administrator directory role inside the B2C tenant. CONDITIONAL if the role is behind PIM activation. BLOCKED if a Conditional Access policy or deny assignment prevents the principal from accessing the MS Graph password reset API. |
Narrative
{principal.name} holds the User Administrator role in B2C tenant {tenant.name} and can reset the password of any B2C consumer account via POST /beta/users/{id}/resetPassword, effectively taking over that consumer's account in all B2C-protected applications.
Raw rule rules/derived/azure/b2c.yaml
id: azure-b2c-user-admin-reset-password
emits: CanResetCredential
description: User Administrator role in B2C tenant can reset B2C consumer account passwords, enabling
account takeover.
match_effective_permission:
action: microsoft.directory/users/password/update
api: MS Graph POST /beta/users/{id}/resetPassword OR /beta/users/{id}/revokeSignInSessions
where:
- principal holds 'User Administrator' directory role inside the B2C tenant
emit:
source_type: Identity
target_type: HumanIdentity
source: <principal>
target: <B2C consumer user account (HumanIdentity)>
permissions:
- microsoft.directory/users/password/update
- UserAuthenticationMethod.ReadWrite.All
conditions:
- iam_permission
state_logic: ACTIVE when the principal holds the User Administrator directory role inside the B2C tenant.
CONDITIONAL if the role is behind PIM activation. BLOCKED if a Conditional Access policy or deny assignment
prevents the principal from accessing the MS Graph password reset API.
confidence: 0.9
derived_from:
- B2C tenant User Administrator directory role assignment
- 'azure/identity-escalation.yaml: azure-reset-password (corporate Entra analogue)'
false_positive_note: User Administrator applies only to the B2C tenant directory where it is assigned,
not the corporate Entra tenant. Resetting a B2C consumer password enables account takeover in B2C-protected
applications; it does not grant access to corporate cloud resources. Confirm the role assignment is
in the B2C directory (Microsoft.AzureActiveDirectory/b2cDirectories), not the corporate Entra tenant.
The directory role action 'microsoft.directory/users/password/update' or the MS Graph delegated/app
permission 'UserAuthenticationMethod.ReadWrite.All' are required for password reset via API.
narrative: '{principal.name} holds the User Administrator role in B2C tenant {tenant.name} and can reset
the password of any B2C consumer account via POST /beta/users/{id}/resetPassword, effectively taking
over that consumer''s account in all B2C-protected applications.'