azure-active-directory

Application consent policies in Azure Active Directory can be used to delegate tenant-wide user and admin consent to other users, groups and applications. This blog post explains how to configure these policies using the Microsoft Graph REST API including a test case to show how a test user is able to grant admin consent to an application it owns.

Azure App Registrations are often used as system identities that have access to API’s. Microsoft Graph is one of these API’s that are often used and has application roles that are high privileged and can be abused by an attacker to escalate privileges.