detection.wiki

Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: AzureRBACRoleManagementElevateAccess

OperationNameDescriptionSampleRule
Assigns the caller to user access adminA Global Administrator elevated access to User Access Administrator over Azure resources.NY
User has elevated their access to User Access Administrator for their Azure ResourcesA Global Administrator elevated access to manage all Azure subscriptions (root-scope RBAC).NY
The role assignment of User Access Administrator has been removed from the userRoot-scope User Access Administrator (elevated access) role assignment was removed from the user.NN

Assigns the caller to user access admin

#
Source
Microsoft Entra ID audit log
Audit Category
AzureRBACRoleManagementElevateAccess

Description

A Global Administrator elevated access to User Access Administrator over Azure resources.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

References #

User has elevated their access to User Access Administrator for their Azure Resources

#
Source
Microsoft Entra ID audit log
Audit Category
AzureRBACRoleManagementElevateAccess

Description

A Global Administrator elevated access to manage all Azure subscriptions (root-scope RBAC).

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • Entra ID Elevated Access to User Access Administrator source high: Identifies when a user has elevated their access to User Access Administrator for their Azure Resources. The User Access Administrator role allows users to manage user access to Azure resources, including the ability to assign roles and permissions. Adversaries may target an Entra ID Global Administrator or other privileged role to elevate their access to User Access Administrator, which can lead to further privilege escalation and unauthorized access to sensitive resources. This is a New Terms rule that only signals if the user principal name has not been seen doing this activity in the last 14 days.T1098, T1098.003

Kusto #

  • Azure RBAC (Elevate Access) source high: Detects when a Global Administrator elevates access to all subscriptions and management groups in a tenant. When a Global Administrator elevates access they are assigned the User Access Administrator role at root scope. This Microsoft Sentinel Analytic Rule monitors who has elevated access in your tenant so that admins can take appropriate action. Learn moreT1078

References #

The role assignment of User Access Administrator has been removed from the user

#
Source
Microsoft Entra ID audit log
Audit Category
AzureRBACRoleManagementElevateAccess

Description

Records removal of the root-scope (/) User Access Administrator role assignment that a Microsoft Entra Global Administrator gained by elevating access to manage all Azure subscriptions and management groups. Removal ends that elevated access; the corresponding grant of this assignment is a notable privilege-escalation signal worth alerting on.

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

  • InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
  • What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.