---
title: >-
  External Microsoft Entra application has administrator-equivalent Azure RBAC
  rights
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > External Microsoft Entra application
  has administrator-equivalent Azure RBAC rights
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# External Microsoft Entra application has administrator-equivalent Azure RBAC rights

## Description{% #description %}

A tenant-local service principal for an application registered in an external Microsoft Entra tenant has administrator-equivalent Azure RBAC rights at the tenant root, a management group, or a subscription. Compromise of the external application or its home tenant could allow an attacker to use those rights to control resources and security settings within that scope.

## Remediation{% #remediation %}

Verify that the external enterprise application is trusted and still required, then remove Azure role assignments that grant unnecessary administrator-equivalent permissions. If the application is no longer required, remove its enterprise application from the tenant. For guidance, refer to [Remove Azure role assignments](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-remove) and [Delete an enterprise application](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/delete-application-portal).