Identity Folding: Edge Consolidation and Risk Weighting for ACL Permissions

Overview

Active Directory security descriptors grant permissions at different scopes, such as "This object only" or "This object and all descendant objects". An identity can inherit one permission from a parent OU and get another granted directly on the same target. Separate ACL entries can also grant distinct rights. The result is several permissions between the same two identities. Combinations such as GenericAll and WriteGPLink, GenericWrite with WriteDacl and WriteOwner, or AddMember with ForceChangePassword and WriteDacl are common. Drawn one line per permission, they clutter the graph and hide the blast radius of a compromise.

Identity Folding™ combines every ACL permission between the same two identities into one ACL permission edge (type HasPermission). It carries:

The list of every permission it holds.
A severity: Critical, High, Medium or Low.
A numeric risk weight.

Entra ID permissions fold the same way. Abusable Entra ID application permissions and OAuth2 delegated grants between two Entra ID identities fold into one ACL permission edge. Entra ID app roles fold into one App role assignment edge per pair.

Planned: Identity Loom™ will join an on-premises account with its Entra ID account, so that permissions from both sides read as one. It isn't available yet. Today an on-premises identity and its Entra ID identity keep separate edges.

The folded, weighted edges feed Graph Explorer, Over-Permission Analytics, the Risk Posture Dashboard, the junction analysis and change simulation.

Prerequisites

At least one finished sync, from a bridge or from Entra ID.
Nothing to set up. Every sync folds the permissions it collects.

What You See in Graph Explorer

One Edge per Pair

In the detail view, two identities that share three ACL permissions have one edge between them. Its label names one permission and counts the others:

Label	What it means
`GenericAll`	One ACL permission: full control over the target
`GenericAll +1`	Two ACL permissions: GenericAll and one other, for example WriteGPLink from a different scope
`ForceChangePassword +2`	Three ACL permissions, one of them ForceChangePassword

The label shows the first permission in alphabetical order, which isn't always the most severe. Select the edge to see all of them and the severity.

The Edge Details

Select an ACL permission edge to open its details. The panel's title is ACL permission. It shows:

The fidelity level and the severity, as badges.
Weight: the edge's risk weight. Hover over it for how it's calculated.
Permissions: how many permissions it holds.
Permissions in this grant: each permission, one per row.
ACE origin: Permissions by origin splits the permissions into explicit and inherited ACEs.
Inherited from: the container the inherited permissions come from.

The Detail View Ranks by Weight

With no identity focused, select Switch to detail view in the toolbar. The graph shows up to 2,000 structural edges and the 500 ACL permission edges with the highest weight. The most dangerous access stays in view even in a large directory, where lower-risk edges would crowd it out.

With an identity focused, the detail view shows its structural edges, up to 2,000 in each direction. It also shows up to 100 inbound and 100 outbound ACL permission, session, privilege and alert edges, highest weight first.

Show or Hide ACL Permissions

Select the funnel button, Show or hide edge types, to open Edge types shown. The ACL permissions switch shows or hides every ACL permission edge at once. Sessions (logons that telemetry observed) have their own switch, as do the structural types.

How Severity Is Classified

An edge's severity is the severity of the most dangerous permission it holds. An edge with GenericAll (Critical) and AddMember (Medium) is Critical.

Severity Levels

Severity	Active Directory permissions
Critical	DCSync, GenericAll, WriteDacl, WriteOwner, AddKeyCredentialLink
High	ForceChangePassword, AllExtendedRights, GenericWrite, WriteSPN, ReadLAPSPassword, GetChangesInFilteredSet, WriteAccountRestrictions, WriteGPLink, ReadGMSAPassword
Medium	AddMember, AllowedToDelegate, HasSIDHistory, AddSelf, AllowedToAct
Low	ReadProperty, WriteProperty, GetChanges, GetChangesAll

Severity	Entra ID application permissions
Critical	Application.ReadWrite.All, Directory.ReadWrite.All, RoleManagement.ReadWrite.Directory
High	AppRoleAssignment.ReadWrite.All, GroupMember.ReadWrite.All, ServicePrincipalEndpoint.ReadWrite.All
Medium	Group.ReadWrite.All

A permission not in these tables counts as Low.

Critical permissions give full control or direct credential theft. On a Tier 0 target, any one of them usually completes a domain compromise with no further step.
High permissions allow serious privilege escalation. ForceChangePassword lets an attacker reset the target's password, and ReadLAPSPassword reveals a managed machine's local administrator password.
Medium permissions give narrower escalation. AddMember widens a group's access, and AllowedToDelegate opens Kerberos delegation abuse.
Low permissions are kept for completeness. On their own they rarely give an attack path. GetChanges and GetChangesAll become DCSync only together.

How the Risk Weight Is Calculated

Each edge's weight, its Access Gravity™, reflects both how dangerous its worst permission is and how many permissions it holds:

Weight = severity value × log₂(permission count + 1)

The severity values are Critical 10, High 8, Medium 6 and Low 4. More permissions raise the weight, with diminishing returns. One Critical permission weighs 10. Seven Critical permissions weigh 30: worse, but not seven times worse.

The weight ranks ACL permission edges in Graph Explorer, so the heaviest ones stay in view.

How This Affects Analysis

Over-Permission Analytics

Over-permission analysis counts permissions, not edges. It adds up the permissions on each ACL permission edge an identity holds, directly and through group membership. One edge that holds five permissions counts as 5.

For example, an identity with GenericAll and WriteGPLink on one target, GenericWrite, WriteDacl and WriteOwner on another, and ForceChangePassword on a third has 6 permissions across 3 edges.

See Over-Permission Analytics for how findings are found and investigated.

Risk Posture Dashboard

The Permission load factor on the Risk Posture Dashboard uses the same permission count as the Over-Permission Analytics page, so the two always agree.

Critical Junction Analysis

The junction analysis follows ACL permission edges as a whole, rather than listing each permission type. A new permission type is covered with no change to the analysis. The analysis prices each edge from its severity and its permission count: the more severe and the more permissions, the cheaper the path. See Critical Junctions.

Change Simulation

Grant access: the simulated edge is an ACL permission edge holding the permissions you name, with its severity and weight worked out for you.
Remove a whole edge: every permission between the two identities is gone in the simulated view.
Remove some permissions: the edge stays with the rest, and its severity and weight are worked out again. An OAuth2 grant can only be removed whole.

Troubleshooting

The graph shows no ACL permissions after a sync

Likely cause: The ACL permissions switch is off.

Fix: Select Show or hide edge types and turn on ACL permissions. That one switch controls every ACL permission edge.

The detail view doesn't show the edge you're looking for

Cause: With no identity focused, the detail view shows only the 500 ACL permission edges with the highest weight. A low-weight edge, such as a single Medium or Low permission, may not make the cut.

Fix: Search for one of the two identities and focus it. The focused view shows up to 100 inbound and 100 outbound ACL permission edges for that identity, highest weight first.

A simulated grant has a lower severity than you expected

Cause: The severity comes from the permissions in the simulated edge. A simulated grant of AddMember alone is Medium, not Critical.

Fix: Check which permissions the simulation included. To simulate a Critical grant, include a Critical permission such as GenericAll.

Best Practices

Open the edge to see all of it. The edge's label names one permission. Select the edge to see every permission, the severity and the weight.
Fix Critical and High edges first. In over-permission and junction findings, start with identities that hold Critical or High ACL permission edges. They're the direct paths to credential theft and domain compromise.
Hide ACL permissions to read structure. When you trace group memberships, OU containment or delegation, turn off ACL permissions to cut the noise. Turn it back on to look at who controls what.