App registrations and their tenant instances, service principals, are first-class identities in Entra, and they are routinely over-permissioned. Control of an app that holds a high-value Microsoft Graph permission is equal to holding that permission yourself, which makes applications a primary escalation and persistence surface.
What folds in here#
- Service principals: enumerating and hijacking app identities and their app roles.
- Consent phishing: luring users or admins into granting a malicious OAuth app.
- API permissions: abusing Microsoft Graph application permissions to reach tenant control.
- Application credentials: adding a secret or certificate to authenticate as an app.
- Federated credentials: adding a federated identity credential to mint tokens without a secret.
- Ownership: abusing app or service-principal ownership to take it over.