Misconfiguration Spotlight: Not Limiting Azure Management to Administrative Roles

“Restricting the admin portal isn’t security. It’s a curtain.”

There’s a dangerous misconception in Entra ID security: that toggling “Restrict access to Microsoft Entra administration portal” to Yes meaningfully limits what non-admin users can do. It doesn’t. That setting hides a few UI pages. It does nothing to block access to the Azure Resource Manager API, PowerShell, the CLI, or Microsoft Graph. Every regular user in your tenant can still authenticate to the Windows Azure Service Management API and start enumerating your subscriptions, resource groups, and more, unless you explicitly tell them they can’t.

This is not a portal problem. It’s an API problem. And the fix is a Conditional Access policy, not a toggle.

Why This Persists

The confusion is baked into the product. Microsoft’s own documentation notes that the portal restriction “limits access to a set of commonly visited admin center pages”, language that sounds comprehensive but isn’t. Admins configure the toggle, see non-admin users hit a “you don’t have access” screen, and move on. Meanwhile, those same users can run Connect-AzAccount and browse the tenant’s Azure resources without obstruction.

Compounding the issue, many organizations don’t think of Azure management access as an identity problem. They treat it as a networking or subscription-level concern, missing the fact that the identity layer is where the real gating needs to happen.

Real-World Risks

OAuth Application Abuse

Users with Azure Management access can discover and interact with app registrations and service principals. In environments where legacy OAuth applications have elevated permissions, a pattern that is disturbingly common, this visibility becomes a launchpad. Attackers enumerate service principals, find overprivileged apps with discoverable secrets, and use them to escalate into production workloads.

AI and Automated Scraping at Scale

Modern threat actors don’t manually poke around portals. They script enumeration at scale using tools like MicroBurst and ROADtools. If every user in your tenant can authenticate to the Azure Resource Manager, you’ve handed every compromised account a license to automate reconnaissance across your entire cloud estate.

Case Studies

Microsoft / Midnight Blizzard (January 2024)

Russian state-sponsored group APT29 compromised a legacy, non-production test tenant account that lacked MFA. From there, they discovered an overprivileged OAuth application with access to Microsoft’s corporate environment, escalated privileges, created malicious OAuth apps, and ultimately gained full access to senior leadership mailboxes, including executives, cybersecurity, and legal teams. The breach was a textbook case of what happens when non-production identities have unrestricted access to management APIs and no one is watching.

Impact: Executive email exfiltration, exposure of sensitive communications with U.S. government agencies, prompting a CISA emergency directive.

Reference: Microsoft Security Blog

Microsoft Power Apps / UpGuard (August 2021)

UpGuard discovered that 47 organizations, including American Airlines, Ford, J.B. Hunt, the State of Indiana, and Microsoft itself, had exposed 38 million records through misconfigured Power Apps portals. OData APIs were left anonymously accessible, leaking COVID-19 contact tracing data, vaccination appointments, Social Security numbers, and employee IDs. Microsoft initially classified this as “by design.” The root issue was the same pattern: default configurations granted broader access than administrators realized, and no one audited what was actually reachable.

Impact: 38 million records exposed across 47 entities, including SSNs and health data. Microsoft subsequently changed defaults to enforce table permissions.

Reference: UpGuard Research

Consequences

• Regulatory exposure. Unrestricted management access that leads to data exposure can trigger obligations under GDPR, HIPAA, and state breach notification laws. Regulators don’t care that you toggled a portal setting, they care that the data was reachable.
• Reconnaissance at zero cost. Every regular user account becomes a potential reconnaissance tool. A single phished credential gives an attacker a complete inventory of your Azure environment without tripping any alarms.
• Lateral movement and escalation. Visibility into subscriptions, Key Vaults, and app registrations provides the map for privilege escalation. Attackers don’t need admin rights to find the path to admin rights.
• Supply chain and multi-tenant risk. Guest users and B2B collaborators who can access the Azure Resource Manager carry that visibility across organizational boundaries. Your partner’s compromised account becomes your problem.
• Reputational damage. Public disclosure of a breach rooted in a default configuration, one that Microsoft themselves documents as insufficient, is an especially painful headline.

Best Practices for Prevention

1. Create a Conditional Access policy targeting the Windows Azure Service Management API. Block all users except a named group of administrators. This is the actual control, not the portal toggle. Target the “Windows Azure Service Management API” cloud app in Conditional Access, set the grant control to Block, and exclude only your admin break-glass and privileged role groups.
2. Enforce MFA on all remaining admin access. For the administrators who do need Azure Management access, require phishing-resistant MFA (FIDO2 or certificate-based) via Conditional Access. Password-only access to management APIs is how breaches like Midnight Blizzard begin.
3. Audit Azure RBAC assignments at every scope. Use Azure Resource Graph queries to enumerate who has roles at the management group, subscription, and resource group levels. Look specifically for broad roles (Owner, Contributor, User Access Administrator) assigned to non-admin users or dynamic groups with loose membership rules.
4. Continuously review OAuth applications and service principals. Legacy apps with broad permissions (like full_access_as_app or Application.ReadWrite.All) are ticking time bombs. Inventory every service principal, verify the owner, confirm the permissions are justified, and rotate credentials on a schedule.
5. Monitor Azure Resource Manager sign-ins in your SIEM. Entra ID sign-in logs capture authentication to the Azure Service Management API. Alert on non-admin users successfully authenticating to this resource. If a marketing coordinator is hitting the ARM API at 2 AM, you want to know about it.

A curtain isn’t a wall, and a portal toggle isn’t access control. Lock the API, not just the UI, because attackers don’t browse, they script. Reclaim Security: from diagnosis to remediation.