Detection rules › By eventAzure-Microsoft.AuthorizationEventRulesMicrosoft.Authorization/elevateAccess/action2Microsoft.Authorization/locks/delete1Microsoft.Authorization/policies/audit/action1Microsoft.Authorization/policies/auditIfNotExists/action1Microsoft.Authorization/policies/deployIfNotExists/action1Microsoft.Authorization/roleAssignments/write5Microsoft.Authorization/elevateAccess/action#2 detection rules reference this event. View event page.Sigma (1)Azure Subscription Permission Elevation Via ActivityLogs severity high T1078, T1078.004 Panther (1)Azure Privileged or Elevated Role Assignment severity medium T1078.004, T1098, T1098.003 Microsoft.Authorization/locks/delete#1 detection rules reference this event. View event page.Panther (1)Azure Resource Lock Deleted severity high T1490, T1685 Microsoft.Authorization/policies/audit/action#1 detection rules reference this event. View event page.Panther (1)Azure Policy Violation Detected severity informationalMicrosoft.Authorization/policies/auditIfNotExists/action#1 detection rules reference this event. View event page.Panther (1)Azure Policy Violation Detected severity informationalMicrosoft.Authorization/policies/deployIfNotExists/action#1 detection rules reference this event. View event page.Panther (1)Azure Policy DeployIfNotExists Action Triggered severity medium T1078.004, T1564 Microsoft.Authorization/roleAssignments/write#5 detection rules reference this event. View event page.Sigma (2)Granting Of Permissions To An Account severity medium T1098, T1098.003 Role Assignment Created severity informationalElastic (1)Azure RBAC Built-In Administrator Roles Assigned severity high T1098, T1098.003 Kusto (1)Suspicious granting of permissions to an account severity medium T1098, T1548 Panther (1)Azure Privileged or Elevated Role Assignment severity medium T1078.004, T1098, T1098.003