📋 Microsoft Entra Documentation Changes

 

**Remediation action**

 

**Remediation action**

 

- [Deploy authentication method registration campaigns to encourage stronger methods](/graph/api/authenticationmethodspolicy-update?view=graph-rest-beta&preserve-view=true)

 

**Remediation action**

 

If administrators assign privileged roles to workload identities, such as service principals or managed identities, the tenant can be exposed to significant risk if those identities are compromised. Threat actors who gain access to a privileged workload identity can perform reconnaissance to enumerate resources, escalate privileges, and manipulate or exfiltrate sensitive data. The attack chain typically begins with credential theft or abuse of a vulnerable application. Next step is privilege escalation through the assigned role, lateral movement across cloud resources, and finally persistence via other role assignments or credential updates. Workload identities are often used in automation and might not be monitored as closely as user accounts. Compromise can then go undetected, allowing threat actors to maintain access and control over critical resources. Workload identities aren't subject to user-centric protections like MFA, making least-privilege assignment and regular review essential.

 

**Remediation action**

While an application with open assignment but proper provisioning scoping (such as department-based filters or group membership requirements) maintains security controls through the provisioning layer, applications lacking both controls create unrestricted access pathways that threat actors can exploit. When applications provision accounts for all users without assignment restrictions, threat actors can abuse compromised accounts to conduct reconnaissance activities, enumerate sensitive data across multiple systems, or use the applications as staging points for further attacks against connected resources. This unrestricted access model is dangerous for applications that have elevated permissions or are connected to critical business systems. Threat actors can use any compromised user account to access sensitive information, modify data, or perform unauthorized actions that the application's permissions allow. The absence of both assignment controls and provisioning scoping also prevents organizations from implementing proper access governance. Without proper governance, it's difficult to track who has access to which applications, when access was granted, and whether access should be revoked based on role changes or employment status. Furthermore, applications with broad provisioning scopes can create cascading security risks where a single compromised account provides access to an entire ecosystem of connected applications and services.

 

**Remediation action**

 

**Remediation action**

 

 

**Remediation action**

 

 

**Remediation action**

 

 

**Remediation action**

 

ms.service: entra-id

ms.subservice: role-based-access-control

ms.topic: include

ms.custom: include file

---

 

 

ms.service: entra-id

ms.subservice: role-based-access-control

ms.topic: include

ms.custom: include file

---

 

 

ms.service: entra-id

ms.subservice: role-based-access-control

ms.topic: include

ms.custom: include file

---

 

 

ms.service: entra-id

ms.subservice: role-based-access-control

ms.topic: reference

ms.author: rolyon

ms.reviewer: abhijeetsinha

ms.custom: generated, it-pro, fasttrack-edit, has-azure-ad-ps-ref, azure-ad-ref-level-one-done, sfi-ga-nochange

 

# Microsoft Entra built-in roles

 

 

This article lists the Microsoft Entra built-in roles you can assign to allow management of Microsoft Entra resources. For information about how to assign roles, see [Assign Microsoft Entra roles](manage-roles-portal.md). If you are looking for roles to manage Azure resources, see [Azure built-in roles](/azure/role-based-access-control/built-in-roles).

 

In Microsoft Entra ID Governance, you can enable business groups to determine which of these guests should have access, and for how long, using:

 

- [entitlement management](entitlement-management-overview.md) in which you can specify the other organizations whose identities are allowed to request access to your organization's resources. When one of the identities request is approved, they're automatically added by entitlement management as a [B2B](../external-id/what-is-b2b.md) guest to your organization's directory. Then, they're assigned appropriate access. Entitlement management automatically removes the B2B guest user from your organization's directory when their access rights expire or are revoked.

 

For more information, see [Govern the employee and guest lifecycle](scenarios/govern-the-employee-lifecycle.md).

 

- [Define certificate based application configuration](https://devblogs.microsoft.com/identity/app-management-policy/)

- [Define trusted certificate authorities for apps and service principals in the tenant](/graph/api/resources/certificatebasedapplicationconfiguration)

- [Define application management policies](/graph/api/resources/applicationauthenticationmethodpolicy)

- [Create a least-privileged custom role to rotate application credentials](/entra/identity/role-based-access-control/custom-create)