diff --git a/src/pentesting-cloud/azure-security/az-services/az-azuread.md b/src/pentesting-cloud/azure-security/az-services/az-azuread.md
index 4bf6a7623..b6fdbaba6 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-azuread.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-azuread.md
@@ -782,6 +782,13 @@ az ad app owner list --id <id> --query "[].[displayName]" -o table
 az ad app list --show-mine
 # Get apps with generated secret or certificate
 az ad app list --query '[?length(keyCredentials) > `0` || length(passwordCredentials) > `0`].[displayName, appId, keyCredentials, passwordCredentials]' -o json
+# Get Global Administrators (full access over apps)
+az rest --method GET --url "https://graph.microsoft.com/v1.0/directoryRoles/1b2256f9-46c1-4fc2-a125-5b2f51bb43b7/members"
+# Get Application Administrators (full access over apps)
+az rest --method GET --url "https://graph.microsoft.com/v1.0/directoryRoles/1e92c3b7-2363-4826-93a6-7f7a5b53e7f9/members"
+# Get Cloud Applications Administrators (full access over apps)
+az rest --method GET --url "https://graph.microsoft.com/v1.0/directoryRoles/0d601d27-7b9c-476f-8134-8e7cd6744f02/members"
+
 ```
 
 {{#endtab }}
@@ -945,7 +952,6 @@ Get-AzDenyAssignment # Get from current subscription
 Get-AzDenyAssignment -Scope '/subscriptions/96231a05-34ce-4eb4-aa6a-70759cbb5e83/resourcegroups/testRG/providers/Microsoft.Web/sites/site1'
 ```
 
-{{#endtab }}
 
 {{#tab name="Raw" }}