A security engineer is reviewing an Entra ID application registration used by an AI model training pipeline. The application has the 'Application.ReadWrite.All' permission granted as an application permission (not delegated). A security review flags this as high risk. What is the specific risk this permission poses?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because the 'Application.ReadWrite.All' Microsoft Graph application permission grants the service principal the ability to create and modify all application registrations and service principals in the tenant. This is dangerous because the application could potentially modify its own registration or create new applications with elevated permissions, enabling privilege escalation.
Full explanation below image
Full Explanation
B is correct because the 'Application.ReadWrite.All' Microsoft Graph application permission grants the service principal the ability to create and modify all application registrations and service principals in the tenant. This is dangerous because the application could potentially modify its own registration or create new applications with elevated permissions, enabling privilege escalation. A is incorrect because password modification requires 'UserAuthenticationMethod.ReadWrite.All' or similar permissions, not Application.ReadWrite.All. C is incorrect because reading email requires 'Mail.Read' permission; Application.ReadWrite.All does not grant access to user mailbox data. D is incorrect because creating global administrator accounts requires directory role assignment permissions, not Application.ReadWrite.All.