Microsoft quietly expands the Entra Application Developer role

Microsoft has silently expanded the Entra Application Developer role, adding 15 new directory permissions on 21 August 2026, increasing its actions from 3 to 18. The new permissions include application-level operations like updating credentials, owners, and permissions, which are typically held by the Application Administrator role. This expansion introduces a potential attack path where an Application Developer could add credentials to existing applications and authenticate as that workload, potentially gaining elevated access if the application has privileged roles or high-impact Graph permissions. The article advises administrators to review all active and eligible assignments, remove unnecessary ones, and investigate changes made after the update to maintain least privilege.