ApplicationIdentity

Forging a CA-trusted cert lets the principal act as the downstream identity.

An IAM principal with cognito-identity:GetOpenIdTokenForDeveloperIdentity can synthesize a developer-authenticated token for any developerUserId in the pool and exchange it for the authenticated role's IAM credentials, bypassing user authentication entirely.

Signing with a key that anchors an auth system forges the trusted identity.

Admin of a SIGN_VERIFY key can self-grant kms:Sign and forge signatures.

An Automation Account with a legacy RunAs account exposes the RunAs service principal certificate to any runbook via Get-AutomationConnection.

A principal that can CanExecuteAs the pipeline's service-connection identity, where that identity holds ARM Contributor/Owner at subscription scope, gains a foothold in that Azure subscription.

DevOps 'Manage service endpoints' permission lets a principal create a new service connection embedding a chosen Entra SP's credentials, enabling identity-swap escalation paths.

A WIF service connection lets a pipeline job request a short-lived Azure DevOps OIDC token that is then exchanged for an ARM access token; any code in the job can call the OIDC endpoint.

Key Vault Administrator can sign with every signing-capable key in the vault.

A vault self-grant equally yields sign on every signing-capable key in the vault.

An API connection referencing a resource in a different Entra tenant represents cross-tenant credential trust.

Signing with an HSM key that backs a token/cert issuer lets the caller sign as that identity.

A service principal holding Application.ReadWrite.All can add itself as the owner of any app registration, granting it permanent owner-level control (credential addition, configuration change) independent of the original permission grant.

A service principal holding Application.ReadWrite.All (or Directory.ReadWrite.All) can add a password or certificate credential to any app registration or service principal in the tenant and then authenticate as that identity, inheriting all its permissions - the identity-plane equivalent of sts:AssumeRole.

A service principal holding Application.ReadWrite.All or Directory.ReadWrite.All can modify the trust configuration of any app registration by adding a federated identity credential (OIDC trust), allowing an attacker-controlled external issuer to obtain tokens as that app without a static secret.

A service principal holding Group.ReadWrite.All, GroupMember.ReadWrite.All, or Directory.ReadWrite.All can add any principal (including itself) to any Entra group, inheriting that group's RBAC role assignments, Graph app role assignments, and any other entitlements the group carries.

A multi-tenant application registration that has been granted admin consent by a foreign Entra tenant creates a cross-tenant trust allowing the app's SP in the foreign tenant to act under the consented permissions. If the app or its home-tenant SP is compromised, the attacker gains a foothold in the foreign tenant - a lateral-movement primitive.

A service principal holding RoleManagement.ReadWrite.Directory can assign any Entra directory role (including Global Administrator) to any principal, achieving tenant takeover - the app-permission equivalent of holding Privileged Role Administrator.

A service principal holding User.ReadWrite.All (or Directory.ReadWrite.All) can reset any non-protected Entra user's password via PATCH /users/{id} with a new passwordProfile, taking over that user's account and inheriting their RBAC and group memberships.

A Private Link Service configured to accept connections from other tenants (via properties.autoApproval or explicit allowedSubscriptions from cross-tenant subscriptions) records a cross-tenant network trust. A PE from a different tenant connecting to this PLS extends network reachability and access across the tenant boundary.

Issue a cert for an attacker-chosen subject/SAN that a downstream trust accepts, impersonating that identity.

Signing as a key that anchors an identity (JWKS/JWT/code-signing) forges that identity.

Reading a credential that is credentials for an identity yields the ability to authenticate as that identity.

Reading a secret that is credentials for an identity yields the ability to authenticate as that identity.

Signing tokens as an identity yields impersonation when a downstream trust validates those signatures.