Privileged identity glossary

What an app registration is in Microsoft Entra ID, how it differs from a service principal, which credentials it holds, and what a lean team should check.

An attack path is a chain of Entra ID relationships that lets an identity reach a privilege it does not hold directly. How to find and cut the chain.

Containment verification is re-reading Entra ID after a response action to confirm the final state instead of trusting the API reply. Why and how.

What Directory.ReadWrite.All lets an app do in Entra ID, why attackers want it, and a Graph query to list every app that holds it in your tenant.

The Global Administrator toggle that grants User Access Administrator at Azure root scope: how it works, why it persists, and how to remove and monitor it.

A cloud-only Entra ID account with permanent Global Administrator rights, kept outside Conditional Access for use only when normal admin access fails.

The Entra ID role with unrestricted tenant control: what it can reach, how to find every holder, and why Microsoft says fewer than five.

Identity blast radius is everything an attacker can reach from one compromised account. How to measure it in Entra ID and Azure, and how to shrink it.

Identity threat detection and response (ITDR) means detecting attacks on identities and acting on them. What Microsoft includes at each license level.

What an illicit consent grant is, how it appears in Entra ID audit logs and Graph objects, why a password reset does not fix it, and how to revoke it.

Non-human identity defined for Entra ID: service principals, app registrations, managed identities, OAuth grants, agent identities, and how to find them.

A PIM eligible assignment is a role its holder activates for a limited time rather than holding permanently. What it needs, where it hides, what to do.

The Entra ID role that can assign any directory role, including Global Administrator: what it can do, where to find it, and how to limit it.

The Entra ID object that holds an app's roles, permissions, and sign-ins in your tenant: how it differs from an app registration and where to find it.

Privileged identity response: governed, verified action on compromised admin and service identities in Entra ID. How it differs from PIM, PAM and ITDR.