## Summary
Adds a new privilege escalation technique to the EntraID privesc page, covering `microsoft.directory/applications.myOrganization/allProperties/update`.
This permission is not present in any built-in role but commonly appears in custom roles delegated to application teams under the assumption that the `.myOrganization` subtype scopes the action to internal-only apps. Since `allProperties` includes `passwordCredentials` and `keyCredentials`, the permission is functionally equivalent to credential-injection capability against every single-tenant app in the tenant.
## Why this matters
The existing page already documents `applications/credentials/update`. The new section complements it by surfacing the custom-role-scoped variant, which is underdocumented and easy to miss during privileged-role audits, admins filter on built-in privileged roles and miss custom roles carrying this single action.
## Testing
The full attack chain was reproduced end-to-end in an isolated Microsoft 365 Business Premium trial tenant:
1. Created a custom role with `applications.myOrganization/allProperties/update` as the only action.
2. Assigned it to a non-privileged victim user.
3. From the victim's session, ran the documented commands to inject a credential into a target single-tenant app and successfully authenticated as the application via `az login --service-principal`.
## References
- https://learn.microsoft.com/entra/identity/role-based-access-control/custom-available-permissions
- https://learn.microsoft.com/entra/identity/role-based-access-control/permissions-reference
- https://learn.microsoft.com/graph/api/application-addpassword
