Azure AD: Limiting Application Administrator Privileges by Application

Introduction to Global Application Administrator Privilege Risks

Assigning the built-in Application Administrator role in Microsoft Entra ID is a common but potentially dangerous practice in many organizations. This simplistic approach exposes the tenant to significant security risks by granting extended privileges across all enterprise applications.

This article details the implementation of custom roles with limited scope assignments to rigorously apply the principle of least privilege in your Azure AD infrastructure.

Architecture of Default Application Administrator Privileges

The built-in Application Administrator role grants extended permissions on:

• All App Registrations in the tenant
• All Enterprise Applications
• Global Application Proxy settings
• Application creation, modification, and deletion

This architecture presents major vulnerabilities:

Potential Attack Vectors

• SSO Hijacking: Modifying redirect URLs to phishing pages
• Data Exfiltration: Adding unauthorized client secrets to app registrations
• Lateral Movement: Exploiting access tokens to compromise other resources
• Persistence: Creating backdoor applications to maintain access

Licensing Prerequisites for Custom Roles

Implementing this security strategy requires specific licenses:

Technical Implementation of Scoped Custom Roles

Creating a custom role with scoped assignment requires a methodical multi-phase approach.

Phase 1: Custom Role Creation

Phase 2: Scoped Assignment

Configuration Validation and Testing

Verification of Granted Permissions

To validate the effectiveness of your implementation, perform the following tests:

Test 1: Authorized Access

• Sign in with an account having the custom role
• Navigate to the application in scope
• Verify that modifications are possible

Test 2: Effective Restrictions

• Attempt to access an application outside the scope
• Confirm that modification access is denied

PowerShell Validation Script

1# Connect to Azure AD tenant
2Connect-AzureAD
3 
4# Retrieve custom roles
5$customRoles = Get-AzureADDirectoryRole | Where-Object {$_.DisplayName -like "*Custom Application Admin*"}
6 
7# Check scoped assignments
8foreach ($role in $customRoles) {
9    $assignments = Get-AzureADScopedRoleMembership -ObjectId $role.ObjectId
10    Write-Host "Role: $($role.DisplayName)"
11    foreach ($assignment in $assignments) {
12        Write-Host "  Member: $($assignment.RoleMemberInfo.DisplayName)"
13        Write-Host "  Scope: $($assignment.AdministrativeUnitObjectId)"
14    }
15}

Governance and Monitoring of Custom Roles

Activity Auditing

Implement continuous monitoring of activities related to custom roles:

1# Search for audit events related to custom roles
2$auditLogs = Get-AzureADAuditDirectoryLogs -Filter "category eq 'RoleManagement'" -Top 100
3 
4$customRoleActivities = $auditLogs | Where-Object {
5    $_.TargetResources.DisplayName -like "*Custom Application Admin*"
6}
7 
8foreach ($activity in $customRoleActivities) {
9    Write-Output "Date: $($activity.ActivityDateTime)"
10    Write-Output "Activity: $($activity.ActivityDisplayName)"
11    Write-Output "Initiated by: $($activity.InitiatedBy.User.UserPrincipalName)"
12    Write-Output "Target: $($activity.TargetResources.DisplayName)"
13    Write-Output "---"
14}

Governance Best Practices

Recommended Security Architecture

For robust implementation, consider the following architecture:

Role Stratification

1. Tier 0: Global Administrator (emergencies only)
2. Tier 1: Privileged Role Administrator (role management)
3. Tier 2: Custom Application Admin (specific applications)
4. Tier 3: Application User (standard usage)

Integration with Azure PIM

1# PIM Configuration for custom roles
2$pimConfig = @{
3    RoleDefinitionId = $customRole.ObjectId
4    MaximumActivationDuration = "PT8H"
5    RequireJustification = $true
6    RequireApproval = $true
7    ApproversRequired = 2
8}
9 
10Set-AzureADPIMRoleSettings @pimConfig

Troubleshooting and Problem Resolution

Common Issues

Error: "Insufficient privileges to complete the operation"

• Verify that you have Entra P2
• Confirm that the user has permissions on the scoped application

Assignment not visible in portal

• Wait up to 15 minutes for propagation
• Check display filters in the portal

Diagnostic Script

1# Diagnosis of effective permissions
2function Test-CustomRoleAccess {
3    param(
4        [string]$UserPrincipalName,
5        [string]$ApplicationId
6    )
7    
8    $user = Get-AzureADUser -ObjectId $UserPrincipalName
9    $app = Get-AzureADServicePrincipal -ObjectId $ApplicationId
10    
11    $roleAssignments = Get-AzureADUserAppRoleAssignment -ObjectId $user.ObjectId
12    
13    $hasAccess = $roleAssignments | Where-Object {
14        $_.ResourceId -eq $app.ObjectId
15    }
16    
17    if ($hasAccess) {
18        Write-Output "✓ User has access to application: $($app.DisplayName)"
19    } else {
20        Write-Output "✗ User does NOT have access to application: $($app.DisplayName)"
21    }
22}

Evolution Toward Zero Trust Architecture

Implementation of scoped custom roles is a fundamental step toward a complete Zero Trust architecture:

• Verify explicitly: Continuous validation of permissions
• Use least privilege access: Maximum restriction of rights
• Assume breach: Limitation of impact in case of compromise

Conclusion

Abandonning global Application Administrator privileges in favor of scoped custom roles represents a significant improvement to your Azure AD tenant's security posture. This technical approach, while requiring Entra P2 licenses, considerably reduces the attack surface by rigorously applying the principle of least privilege.

Implementation of this strategy, combined with appropriate governance and continuous monitoring, constitutes an essential pillar of a modern and resilient security architecture in the face of current threats.