Authentication Extensibility Administrator
Attack path
Authentication Extensibility Administrator can create and manage custom authentication extensions used during sign-up or token issuance. An attacker could alter an extension to call infrastructure they control or manipulate the attributes and claims returned to applications that trust the extension. Depending on how those applications authorise users, forged or modified claims may provide access as another user or with a stronger application role. The impact is governed by the extension's configuration and the downstream application's trust decisions rather than by a direct Entra role assignment.
Description
Customize sign in and sign up experiences for users by creating and managing custom authentication extensions.
Details
Users with this role can create and manage all aspects of custom authentication extensions. A custom authentication extension is an API endpoint created by a developer for authentication events and is registered in Microsoft Entra ID. Application administrators and application owners can use custom authentication extensions to customize their application's authentication experiences such as sign in and sign up, or password reset. This role does not grant the ability to apply the custom authentication extensions to applications.
Directory Actions1
| Action | Condition |
|---|---|
microsoft.directory/customAuthenticationExtensions/allProperties/allTasks | null |
Graph API Permissions2
Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.
CustomAuthenticationExtension.Read.AllCustomAuthenticationExtension.ReadWrite.All