Privileged accounts and roles
Privileged accounts and roles are the heart of any directory service and are the most powerful accounts/roles. Therefore, they are of special interest to adversaries and need an extra level of protection.
There are lots of built-in roles available in AAD. In this chapter, I won’t describe all of them, but will give you an overview of some important roles that have permissions that could be easily abused. Therefore, it makes sense to regularly check and audit which accounts do have those roles assigned:
- Global Administrator: This is the most powerful role in AAD. It is allowed to perform every administrative task that is possible within AAD.
- Privileged Role Administrator: This role can manage and assign all AAD roles, including the Global Administrator role. This role can also create and manage groups that can be assigned to AAD roles, as well as manage Privileged Identity Management and administrative units.
- Global Reader: This...
