A security engineer is reviewing an Entra ID application registration used by an AI model training pipeline. The application has the 'Application.ReadWrite.All' permission granted as an application permission (not delegated). A security review flags this as high risk. What is the specific risk this permission poses?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — the option saying the application can create new application registrations, modify existing ones, and potentially escalate its own permissions is correct because 'Application.ReadWrite.All' gives the service principal broad control over app registrations and service principals. That means it can change its own permissions or create another app with more rights, which is a serious privilege-escalation risk.
Full Explanation
The correct answer is the option stating that the application can create new application registrations, modify existing ones, and potentially escalate its own permissions. The 'Application.ReadWrite.All' Microsoft Graph application permission grants the service principal the ability to create and modify all application registrations and service principals in the tenant. This is dangerous because the application could potentially modify its own registration or create new applications with elevated permissions, enabling privilege escalation. The option about modifying all users' passwords is incorrect because password modification requires 'UserAuthenticationMethod.ReadWrite.All' or similar permissions, not 'Application.ReadWrite.All'. The option about reading all user emails and calendar data is incorrect because reading email requires 'Mail.Read' permission; 'Application.ReadWrite.All' does not grant access to user mailbox data. The option about creating new global administrator accounts is incorrect because creating global administrator accounts requires directory role assignment permissions, not 'Application.ReadWrite.All'.