Power Platform - Account added to privileged Microsoft Entra roles

Status: available
Severity: low
Time window: 1d
Source: github.com/Azure/Azure-Sentinel

Identifies changes to privileged directory roles impacting Power Platform: - Dynamics 365 Admins - Power Platform Admins - Fabric Admins

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1068` Exploitation for Privilege Escalation `T1078` Valid Accounts `T1548` Abuse Elevation Control Mechanism

Telemetry coverage

Platform	Record / event type
Azure	any: Entra ID audit event (any operation)

Rules detecting the same action

These rules filter on the same operation.

Rule body

id: 71d829d6-eb50-4a17-8a64-655fae8d71e1
kind: Scheduled
name: Power Platform - Account added to privileged Microsoft Entra roles
description: |
  Identifies changes to privileged directory roles impacting Power Platform:
  - Dynamics 365 Admins
  - Power Platform Admins
  - Fabric Admins
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - AuditLogs
queryFrequency: 1h
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - PrivilegeEscalation
relevantTechniques:
  - T1078
  - T1068
  - T1548
query: |
  // 44367163-eba1-44c3-98af-f5787879f96a = Dynamics 365 Administrator
  // 11648597-926c-4cf3-9c36-bcebb0ba8dcc = Power Platform Administrator
  // a9ea8996-122f-4c74-9520-8edcd192826c = Fabric Administrator
  let query_frequency = 1h;
  let role_template_ids = dynamic(["44367163-eba1-44c3-98af-f5787879f96a", "11648597-926c-4cf3-9c36-bcebb0ba8dcc", "a9ea8996-122f-4c74-9520-8edcd192826c"]);
  let monitored_activities = dynamic(["Assign", "AssignGrantedRole", "AssignPermanentGrantedRole", "AssignPermanentEligibleRole", "RoleElevatedOutsidePimAlert"]);
  AuditLogs
  | where TimeGenerated >= ago(query_frequency)
  | where Category == "RoleManagement"
      and TargetResources has_any (role_template_ids)
      and AADOperationType in (monitored_activities)
      and Identity != "MS-PIM" and Identity != "MS-PIM-Fairfax"
  | extend
      UserPrincipalName = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName),
      AadUserId = tostring(parse_json(tostring(InitiatedBy.user)).id),
      IPAddress = tostring(parse_json(tostring(InitiatedBy.user)).ipAddress),
      RoleName = tostring(TargetResources[0].displayName),
      UserAdded = tostring(TargetResources[2].userPrincipalName)
  | extend
      RoleName = iif(isempty(RoleName), tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[1].newValue), RoleName),
      UserAdded = iif(isempty(UserAdded), tostring(parse_json(tostring(TargetResources[0].userPrincipalName))), UserAdded),
      CloudAppId = int(32780),
      AccountName = tostring(split(UserPrincipalName, '@')[0]),
      UPNSuffix = tostring(split(UserPrincipalName, '@')[1])
  | project
      TimeGenerated,
      Identity,
      UserPrincipalName,
      AadUserId,
      RoleName,
      OperationName,
      UserAdded,
      TargetResources,
      CloudAppId,
      AccountName,
      UPNSuffix
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
  - entityType: CloudApplication
    fieldMappings:
      - identifier: AppId
        columnName: CloudAppId
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: UPNSuffix
alertDetailsOverride:
  alertDisplayNameFormat: Power Platform - Account added to privileged role {{RoleName}}
  alertDescriptionFormat: 'A user {{UserAdded}} was added to one of the Power Platform
    administrative roles: {{{RoleName}}'
version: 3.2.1

Stages and Predicates

Parameters

let query_frequency = 1h;
let role_template_ids = dynamic(["44367163-eba1-44c3-98af-f5787879f96a", "11648597-926c-4cf3-9c36-bcebb0ba8dcc", "a9ea8996-122f-4c74-9520-8edcd192826c"]);
let monitored_activities = dynamic(["Assign", "AssignGrantedRole", "AssignPermanentGrantedRole", "AssignPermanentEligibleRole", "RoleElevatedOutsidePimAlert"]);

Stage 1: `source`

AuditLogs

Stage 2: `where`

| where TimeGenerated >= ago(query_frequency)

Stage 3: `where`

| where Category == "RoleManagement"
    and TargetResources has_any (role_template_ids)
    and AADOperationType in (monitored_activities)
    and Identity != "MS-PIM" and Identity != "MS-PIM-Fairfax"

Stage 4: `extend`

| extend
    UserPrincipalName = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName),
    AadUserId = tostring(parse_json(tostring(InitiatedBy.user)).id),
    IPAddress = tostring(parse_json(tostring(InitiatedBy.user)).ipAddress),
    RoleName = tostring(TargetResources[0].displayName),
    UserAdded = tostring(TargetResources[2].userPrincipalName)

Stage 5: `extend`

| extend
    RoleName = iif(isempty(RoleName), tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[1].newValue), RoleName),
    UserAdded = iif(isempty(UserAdded), tostring(parse_json(tostring(TargetResources[0].userPrincipalName))), UserAdded),
    CloudAppId = int(32780),
    AccountName = tostring(split(UserPrincipalName, '@')[0]),
    UPNSuffix = tostring(split(UserPrincipalName, '@')[1])

Stage 6: `project`

| project
    TimeGenerated,
    Identity,
    UserPrincipalName,
    AadUserId,
    RoleName,
    OperationName,
    UserAdded,
    TargetResources,
    CloudAppId,
    AccountName,
    UPNSuffix

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AADOperationType`	in	`Assign` `AssignGrantedRole` `AssignPermanentEligibleRole` `AssignPermanentGrantedRole` `RoleElevatedOutsidePimAlert`	`field:"AADOperationType" kind:in`
`Category`	eq	`RoleManagement`	`field:"Category" kind:eq value:"RoleManagement"`
`Identity`	ne	`MS-PIM` `MS-PIM-Fairfax`	`field:"Identity" kind:ne`
`TargetResources`	match	`11648597-926c-4cf3-9c36-bcebb0ba8dcc` transforms: `term` `44367163-eba1-44c3-98af-f5787879f96a` transforms: `term` `a9ea8996-122f-4c74-9520-8edcd192826c` transforms: `term`	`field:"azure_ad::target_resources" kind:match`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AadUserId`	`project`
`AccountName`	`project`
`CloudAppId`	`project`
`Identity`	`project`
`OperationName`	`project`
`RoleName`	`project`
`TargetResources`	`project`
`TimeGenerated`	`project`
`UPNSuffix`	`project`
`UserAdded`	`project`
`UserPrincipalName`	`project`