Transitive control of Entra application identities

An identity’s effective privilege may include another identity’s permissions if it can control that identity’s credentials or trust configuration. Direct role lists therefore understate what an attacker can reach through a chain of management operations.

Research anchor and scope

Sébastien Rolland’s Entra research distinguishes application registrations from tenant service principals, requested permissions from consented grants, and direct permissions from transitive control. It also notes service-principal credentials that portal-only reviews can miss. Published April 30, 2026, the article describes QAZPT with partial group-membership coverage. Its graph findings require tenant-specific permissions and credential behavior; they are not an automatic privilege-escalation path for every application owner.

Give each edge a precise meaning

Create separate nodes for users, groups, application registrations, service principals, API resources, and credential subjects. An “owns” relationship is different from an “assigned API role” relationship. An application registration requests a permission; an actual grant authorizes the service principal. Treating both as identical overstates access.

A toy graph has user U allowed to add a credential to application A, paired with service principal S, which holds a granted role on resource R. If the credential is accepted for authentication and S’s role authorizes the desired operation, U can act through S toward R. Every clause is a required edge condition. Ownership alone is not equivalent to global administrative access.

Collect the evidence behind reachability

For each proposed hop, record object IDs, tenant, operation permission, credential type, grant state, and resource audience. Display names can collide and are unsuitable as keys. Federated identity trust adds issuer, subject, and audience matching; control of an external subject is useful only when the configured trust admits its assertions.

Keep delegated and application access separate. Delegated access involves a signed-in user and is constrained by the user’s rights as well as granted scopes. Application access can act without that user, but needs its own grants. A consented permission in one tenant does not automatically apply to a service principal in another.

Verify without turning inventory into a claim

Prefer read-only enumeration to build the candidate graph, then explain which state-changing action would make a hop concrete. Use a disposable test application if credential behavior needs confirmation. Do not collect or display existing secrets; credential metadata and authority to create a credential usually provide the necessary evidence.

Graph reachability can produce false positives when policy, ownership rules, role scope, or unsupported API operations block an edge. Missing group membership can also hide genuine paths. State the collection permissions and incomplete edge types. A useful result identifies the exact trust or management link that connects a modest foothold to a stronger identity, plus the evidence needed to validate or remove it.