RBAC Privilege Escalation
How RBAC Privilege Escalation works
Misconfigured custom roles or assignments allow users to grant themselves or others higher privileges. Patterns include roles with Microsoft.Authorization/roleAssignments/write, roleDefinitions/write, users with User Access Administrator at broad scopes, or the ability to assign privileged Managed Identities. Combining Contributor with User Access Administrator effectively equals Owner.
RBAC Privilege Escalation in practice
Detect Escalation Permissions
az role definition list --query "[?permissions[?actions && contains(join('', actions), 'Microsoft.Authorization/roleAssignments/write')]]"
az role assignment list --assignee <objId> --all -o tableAttempt Assignment
az role assignment create --assignee <objId> --role 'Owner' --scope <scope>If successful without intended controls, escalation exists.
How to fix and prevent RBAC Privilege Escalation
- Remove
roleAssignments/writefrom custom roles unless essential. - Limit assignment rights to privileged identities; require PIM and approval workflows; avoid granting
User Access Administratorat subscription. - Monitor and prevent
- Alert on role definition/assignment changes; enforce least privilege via Azure Policy; review assignments for combined permission paths.
Last updated
