Azure user-assigned managed identity trusts an external OIDC issuer and can escalate privileges to obtain administrator-equivalent RBAC rights

azure

Description

An Azure user-assigned managed identity has a federated identity credential that trusts an OIDC issuer associated with another Microsoft Entra tenant or a non-Entra identity provider, and its service principal can escalate privileges to obtain administrator-equivalent Azure RBAC rights at the tenant root, a management group, or a subscription. An attacker who can obtain a token from the external issuer as this identity could authenticate as the managed identity and escalate privileges.

Remediation

  1. Verify that the federated identity credential’s issuer, subject, and audience are expected. Delete the credential if the external trust is unnecessary. See Configure a user-assigned managed identity to trust an external identity provider.
  2. Remove unnecessary privilege-escalation permissions from the managed identity and grant only the permissions required by the workload. See Remove Azure role assignments.