Must read this analysis of EntraID critical roles from an attacker's perspective because they enable (by Elli Shlomo, based on Merril Fernando diagram): - Initial Privilege Escalation: Compromising a low-profile role like Application Administrator or Password Administrator can lead to lateral movement toward high-privilege roles. - Persistent Access – Roles like Cloud Device Administrator or Hybrid Identity Administrator allow attackers to implant backdoors in identity sync or device trust. - Data Exfiltration: Exchange Recipient Admin, Teams Admin, or SharePoint Admin roles can enable data leaks at scale via inbox rules, chat exports, or sharing links. - Defense Evasion: Security Reader or Compliance Admin roles provide visibility into what detections exist—and how to avoid them. - Service Principal Takeover: Application Administrator can be used to manipulate enterprise apps and inject malicious redirect URIs or secrets. - Covert Communication Channels – Abuse Teams Communications Admin or Yammer Admin to create rogue channels or hidden groups. - Privileged Role Loops – Compromise of Privileged Role Administrator enables attackers to assign themselves any other role—including reassigning Global Admins. #TrustEverybodyButCutTheCards