---
title: >-
  Microsoft Entra app registration trusts an external OIDC issuer and its
  associated service principal can escalate privileges to obtain
  administrator-equivalent RBAC rights
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Microsoft Entra app registration trusts
  an external OIDC issuer and its associated service principal can escalate
  privileges to obtain administrator-equivalent RBAC rights
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Microsoft Entra app registration trusts an external OIDC issuer and its associated service principal can escalate privileges to obtain administrator-equivalent RBAC rights

## Description{% #description %}

A Microsoft Entra app registration has a federated identity credential that trusts an OIDC issuer associated with another Microsoft Entra tenant or a non-Entra identity provider, and its associated service principal can escalate privileges to obtain administrator-equivalent Azure RBAC rights at the tenant root, a management group, or a subscription. An attacker who can obtain a token from the external issuer as this identity could authenticate as the application and use the service principal to escalate privileges.

An issuer is considered external when it is outside the identity's Microsoft Entra tenant, even if your organization owns or manages the workloads using it. The finding identifies external federation combined with administrative permissions or a privilege-escalation path; it does not establish whether that federation is expected.

## Remediation{% #remediation %}

1. Verify that the federated identity credential's issuer, subject, and audience are expected. Delete the credential if the external trust is unnecessary. See [Configure an app to trust an external identity provider](https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation-create-trust).
1. Remove unnecessary privilege-escalation permissions from the service principal and grant only the permissions required by the application. See [Remove Azure role assignments](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-remove).