Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: AzureRBACRoleManagementElevateAccess

OperationName	Description	Sample	Rule
Assigns the caller to user access admin	A Global Administrator elevated access to User Access Administrator over Azure resources.	N	Y
User has elevated their access to User Access Administrator for their Azure Resources	A Global Administrator elevated access to manage all Azure subscriptions (root-scope RBAC).	Y	Y
The role assignment of User Access Administrator has been removed from the user	Root-scope User Access Administrator (elevated access) role assignment was removed from the user.	N	N

Assigns the caller to user access admin

Source: Microsoft Entra ID audit log
Audit Category: AzureRBACRoleManagementElevateAccess

Description

A Global Administrator elevated access to User Access Administrator over Azure resources.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`Category`	1 detection rule	Sigma
`OperationName`	1 detection rule	Sigma

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Sigma #

Azure Subscription Permission Elevation Via AuditLogs source high: Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.T1078

References #

User has elevated their access to User Access Administrator for their Azure Resources

Source: Microsoft Entra ID audit log
Audit Category: AzureRBACRoleManagementElevateAccess

Description

A Global Administrator elevated access to manage all Azure subscriptions (root-scope RBAC).

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`ActivityDisplayName`	2 detection rules	Elastic, Kusto
`Category`	1 detection rule	Kusto

Example Audit Log Entry #

{
  "AADTenantId": "00000000-0000-4000-8000-000000000074",
  "ActivityDisplayName": "User has elevated their access to User Access Administrator for their Azure Resources",
  "AdditionalDetails": [
    {
      "key": "APP ID",
      "value": "redacted"
    },
    {
      "key": "Resource",
      "value": "redacted"
    },
    {
      "key": "OperationName",
      "value": "redacted"
    }
  ],
  "Category": "AzureRBACRoleManagementElevateAccess",
  "CorrelationId": "00000000-0000-4000-8000-0000000000b2",
  "InitiatedBy": "redacted",
  "LoggedByService": "Azure RBAC (Elevated Access)",
  "OperationName": "User has elevated their access to User Access Administrator for their Azure Resources",
  "Result": "success",
  "TargetResources": [
    {
      "id": null,
      "displayName": null,
      "modifiedProperties": [],
      "administrativeUnits": []
    }
  ]
}

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Elastic #

Entra ID Elevated Access to User Access Administrator source high: Identifies when a user has elevated their access to User Access Administrator for their Azure Resources. The User Access Administrator role allows users to manage user access to Azure resources, including the ability to assign roles and permissions. Adversaries may target an Entra ID Global Administrator or other privileged role to elevate their access to User Access Administrator, which can lead to further privilege escalation and unauthorized access to sensitive resources. This is a New Terms rule that only signals if the user principal name has not been seen doing this activity in the last 14 days.T1098, T1098.003

Kusto #

Azure RBAC (Elevate Access) source high: Detects when a Global Administrator elevates access to all subscriptions and management groups in a tenant. When a Global Administrator elevates access they are assigned the User Access Administrator role at root scope. This Microsoft Sentinel Analytic Rule monitors who has elevated access in your tenant so that admins can take appropriate action. Learn moreT1078

References #

The role assignment of User Access Administrator has been removed from the user

Source: Microsoft Entra ID audit log
Audit Category: AzureRBACRoleManagementElevateAccess

Description

Records removal of the root-scope (/) User Access Administrator role assignment that a Microsoft Entra Global Administrator gained by elevating access to manage all Azure subscriptions and management groups. Removal ends that elevated access; the corresponding grant of this assignment is a notable privilege-escalation signal worth alerting on.

References #

Computed Fields in AuditLogs #

Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.

Initiating* values come from InitiatedBy: InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, or InitiatedBy.user.id; application actors use InitiatedBy.app.displayName or InitiatedBy.app.appId.
Change details come from TargetResources[].modifiedProperties. Expand TargetResources before using displayName, oldValue, or newValue.

Sources: the AuditLogs table reference and Graph directoryAudit resource.