Directory.ReadWrite.All Is Not As Powerful As You Might Think

Directory.ReadWrite.All is an MS Graph permission that is frequently cited as granting high amounts of privilege, even being equated to the Global Admin Entra ID role.

Why it matters

• Azure admins and security professionals may put undue focus on this permission at the expense of more impactful permissions


• Those more impactful permissions may go ignored, leaving potentially dangerous configurations in place

Yes, but…

• Directory.ReadWrite.All does grant some privileges, and those privileges can lead to dangerous attack paths depending on other …

admin azure directory entra entra id focus global graph high may permission permissions privilege professionals readwrite role security security professionals