How a compromised Azure Function App can forge claims inside Microsoft Entra tokens

A new technical deep-dive warns that Azure resources hosting Microsoft Entra extension points sit on the Control Plane and deserve the same security treatment as domain controllers. The article focuses on custom claims providers built as Azure Function Apps, which Entra calls during token issuance to inject claims into access tokens used by applications for authorization decisions. A compromised Function App could allow an attacker to forge claims, effectively manipulating what downstream applications trust as Entra-asserted identity data. The blast radius spans the source repository, CI/CD pipeline, deployment credentials, and every Azure RBAC role from the resource up to the management-group root. The piece argues that overly permissive RBAC inheritance makes these critical resources dangerously easy to compromise from far up the Azure management hierarchy.