High-risk Microsoft Graph permissions: why some applications are Tier 0
Privilege reviews tend to focus on directory roles assigned to users. Yet an application holding the right Microsoft Graph permission can promote itself to Global Administrator, with no MFA, no Conditional Access and without ever appearing in the list of administrators.
Delegated versus application permissions
A delegated permission is exercised on behalf of a signed-in user: the application can never do more than the user is allowed to do. An application permission (app role) is exercised by the application alone, across the whole tenant. That second category carries the greatest risk, because obtaining a secret or certificate for the application is enough to wield it.
Permissions that lead to full control
Some permissions allow you, directly or in one step, to obtain Global Administrator or an equivalent:
| Permission | Why it is critical |
|---|---|
RoleManagement.ReadWrite.Directory | Can assign any directory role, including Global Administrator, to any principal. |
AppRoleAssignment.ReadWrite.All | Can grant any application permission, and therefore the other permissions in this table, without consent. |
Application.ReadWrite.All | Can add credentials to any application, and so impersonate the most privileged one. |
UserAuthenticationMethod.ReadWrite.All | Can add an authentication method, such as a Temporary Access Pass, to an administrator's account. |
Policy.ReadWrite.ConditionalAccess | Can disable or modify Conditional Access policies. |
This list is not exhaustive. Permissions change and new ones appear, so check the current Microsoft documentation and always think in terms of paths: what does this permission let you obtain next?
Data access permissions
Other permissions do not give control of the directory, but they do give bulk access to data. Mail.ReadWrite, Mail.Read or Mail.Send as application permissions cover every mailbox in the tenant by default, including those of the executive team. Files.ReadWrite.All and Sites.FullControl.All cover all of SharePoint and OneDrive.
These scopes can be narrowed: RBAC for Applications in Exchange Online limits access to a defined set of mailboxes, and Sites.Selected grants access to specific sites rather than all of them.
Why Tier 0. An identity that can gain control of the tenant belongs at the same level as Global Administrators. Its owner, the server or pipeline holding its secret, and the application administrators all inherit that level of sensitivity.
Reducing exposure
- Inventory every app role assignment on Microsoft Graph and the other first-party APIs;
- For each sensitive permission, ask the owning team what they actually need and offer a narrower permission;
- Protect the remaining applications like Tier 0 accounts: certificates rather than secrets, few owners, monitoring of sign-ins and changes;
- Require explicit security sign-off for any new request for a sensitive permission.
In the tenants we audit, these permissions are frequently held by migration, backup or reporting tools installed years ago that nobody remembers any more.
What an audit checks
- Service principals holding application permissions that allow escalation to Global Administrator.
- Tenant-wide data access permissions and any use of restricted scopes.
- The owners and credentials of those applications.
- Their sign-in activity and recent changes to their permissions.