Escalating from Azure AD to Azure RBAC roles

As highlighted in Figure 7.1, an Azure AD role assignment does not grant access to manage Azure resources and an Azure RBAC role assignment does not grant access to manage Azure AD resources by default:

Figure 7.1 – Azure AD roles versus Azure RBAC roles

To prevent lateral movement, the best practice is to keep both planes (Azure AD and Azure resources) separate. This means that separate user accounts should be used to administer them. If this best practice is not followed, the compromise of an identity that has access to Azure AD can be leveraged to move laterally to Azure resources and vice versa.

With that being said, there are other options that an attacker could look to exploit even if user accounts are kept separate for Azure AD and Azure resources. We will look at some of those options in the next sections.

Path 1 – Exploiting group membership

An Azure AD account may not have default...