Azure Privilege Escalation Paths

You have obtained credentials for a low-privilege Azure AD user. Your goal is to reason through privilege escalation paths in the Azure environment.

**Identity & Role Analysis**
- What Azure AD roles, subscription roles (RBAC), and custom roles should you enumerate?
- How do Owner, Contributor, and User Access Administrator differ in exploitation potential?
- What does "privileged role administrator" allow you to do?

**Service Principal & App Registration Abuse**
- How can you abuse an app registration with high-privilege API permissions?
- What is the difference between delegated permissions and application permissions, and which is more dangerous?
- How do you add credentials to an existing service principal if you have the right permissions?

**Managed Identity Exploitation**
- What is a managed identity and when does it represent a privilege escalation vector?
- How do you query the IMDS endpoint from inside an Azure VM or Function App?
- If a VM's managed identity has Contributor on a subscription, what can you do next?

**Common Escalation Paths**
- Logic App → Key Vault → credentials
- Automation Account → RunAs Account → subscription access
- Function App with system-assigned identity → resource access

Constraints:
- Authorized assessment only
- For each path, reason about what evidence gets logged in Azure

Output:
- Escalation decision tree
- 3 most common real-world paths with step-by-step reasoning
- Detection indicators per path