AZCloudAppAdmin

The principal has the Cloud Application Administrator Entra ID role active and can control tenant-resident apps.

Abuse Info

Create a new credential for the app, then authenticate to the tenant as the app’s service principal, then abuse whatever privilege it is that the service principal has.

Opsec Considerations

The Azure portal will create a log even whenever a new credential is created for a service principal.

References

• Microsoft Entra built-in roles: Cloud Application Administrator
• https://dirkjanm.io/azure-ad-privilege-escalation-application-admin/