An attack path is a chain of Microsoft Entra ID relationships, for example user to group to role-assignable group to directory role, that lets an identity reach a privilege it does not hold directly. Each link is a legitimate object or assignment: a group membership, a group ownership, an application owner, an OAuth grant, an Azure role assignment. None is a misconfiguration on its own. Together they give an ordinary-looking identity a route to Global Administrator or to every subscription in the tenant.
Why it matters to a lean team
A one to five person security team usually counts privileged access by listing direct role assignments. Attack paths hide behind that count. An account that owns a group holding a directory role is not a direct holder of the role, so it is rarely reviewed or protected with the same care. When it is phished, the attacker follows a chain that already exists in the directory, and the audit log records ordinary administrative actions. Knowing the paths tells you which identities need admin-grade protection and, during an incident, what a compromised account can reach beyond the roles you can see.
How it shows up in Entra ID and Azure
Group owner to directory role. Microsoft recommends assigning Entra roles to role-assignable groups when an external governance system manages groups, and notes that a Privileged Role Administrator can delegate role management by making someone the owner of a role-assignable group. Whoever owns the group controls who holds the role. Microsoft's guidance is to manage those groups in PIM so there are no standing owners or members. The path reads: user, owns, role-assignable group, assigned to, directory role.
Global Administrator to Azure root scope. A Global Administrator does not automatically have access to Azure subscriptions; Entra roles and Azure roles are separate systems. The elevate access toggle (Microsoft Entra ID, Manage, Properties, "Access management for Azure resources") assigns the caller User Access Administrator at root scope (/), which can assign access in any subscription or management group, including Owner to itself or others. Deactivating a PIM Global Administrator assignment does not turn the toggle off. The path reads: user, holds, Global Administrator, elevates to, User Access Administrator at root, assigns, Owner on any subscription.
What to do about it
- Inventory every role-assignable group with its owners and members, and treat each owner as a privileged account. Microsoft recommends managing these groups in PIM so ownership and membership are time-bound.
- Check who holds User Access Administrator at root scope and remove elevated access once the root-scope work is done. Microsoft says the same user sets the toggle back to No, or removes it with Azure PowerShell, Azure CLI, or REST; elevate and remove events appear in the Entra audit logs and the Azure activity logs.
- Follow the chain, not the role list, when scoping an incident. An account with no direct role may still reach one through a group it owns.
- Run recurring access reviews, which Microsoft recommends for removing role assignments no longer needed, and include group ownership in them.
Related terms
- Identity blast radius: everything an attacker can reach from one identity; attack paths are the routes inside it.
- Privileged Role Administrator: the role that creates role-assignable groups and assigns any Entra role, including Global Administrator.
- Elevate access: the Global Administrator toggle that grants User Access Administrator at the Azure root scope.
- PIM eligible assignment: a role assignment activated before use, the mechanism Microsoft recommends for removing standing owners and members.
- Privileged identity response: governed action on a compromised or over-privileged identity after detection.
Browse the full glossary, or read how many Global Administrators a tenant should have and privileged access without Entra ID P2.
Where Orbitra fits
Orbitra puts human and non-human identities (service principals, app registrations, OAuth grants, managed identities) in one graph with blast radius traversal across users, groups, apps, service principals, roles, and Azure RBAC. Blast radius shows what an identity can reach before you act, and what remains reachable after; it is impact calculation, not proof of exploitability. When a response is needed, Orbitra recommends from an allowlisted catalog of more than two dozen governed response actions. In Recommend mode, your team executes it; in Approve mode, a named person signs off before Orbitra executes. Orbitra independently re-reads Microsoft after supported response actions to verify the final state. It works alongside Microsoft native controls. Connect Microsoft in minutes and start read-only.
Sources
- Best practices for Microsoft Entra roles (role-assignable groups, PIM, access reviews)
- Microsoft Entra built-in roles (Privileged Role Administrator)
- Elevate access to manage all Azure subscriptions and management groups
- Azure built-in roles: Privileged (User Access Administrator, Owner)
- All Microsoft Learn pages checked September 2026.