Privilege Escalation via Service Principal Ownership #shorts

you are a low privilege user that have an ownership over a privilege uh service principle um which has the role of PA which is privilege authentication administrator. This role can basically reset h and set every password or for any user in the tenant. So uh in Microsoft enter ID ownership is a feature because you want to delegate administrative actions. So a low privilege user can be an owner of a high privilege service principle and the attack path is very straightforward. You basically add a client uh a client secret to the service principle. You authenticate uh in the app only context meaning you operate in the in the context of the application itself. Uh and that way you can get its privileges

and reset the global admin password. very very straightforward again really beginner friendly just to grasp the understanding the initial understanding of what it's look like to operate uh from a application context