Exchange Recipient Administrator
Attack path
Exchange Recipient Administrator can change recipient attributes, creating a risk in hybrid environments that use directory synchronisation and SMTP matching. If an attacker also controls, or can influence, the corresponding on-premises recipient object, they may manipulate matching attributes so that a synchronised identity is joined to the wrong cloud account. This could expose mail or transfer control of an account with eligible privileges. The escalation requires weaknesses in hybrid identity administration as well as the Exchange role; the cloud role alone does not provide control of on-premises Active Directory.
Description
Can create or update Exchange Online recipients within the Exchange Online organization.
Details
Users with this role have read access to recipients and write access to the attributes of those recipients in Exchange Online.
Directory Actions2
| Action | Condition |
|---|---|
microsoft.office365.exchange/migration/allProperties/allTasks | null |
microsoft.office365.exchange/recipients/allProperties/allTasks | null |
Graph API Permissions13
Microsoft do not provide a direct mapping between Directory actions and Graph API permissions, despite this being necessary for delegated (interactive) access. MSAdminRoles.com has meticulously compiled a list of the Graph API permissions that each built-in admin role enables you to utilise. Please note this listing is not 100% accurate. Graph API permissions and Entra RBAC operate as two independent authorisation planes and do not map to each other on a one-to-one basis.
Calendars.ReadCalendars.ReadWriteContacts.ReadContacts.ReadWriteExchangeMessageTrace.Read.AllMail.ReadMail.ReadWriteMailboxSettings.ReadMailboxSettings.ReadWritePlace.Read.AllPlace.ReadWrite.AllRoleManagement.Read.ExchangeRoleManagement.ReadWrite.Exchange