Azure AD Admin Consent Bypassed by Service Principal

The analytic identifies instances where a service principal in Azure Active Directory assigns app roles without standard admin consent. This activity is detected by analyzing Entra ID logs from the `azure_monitor_aad` data source, specifically looking for "Add app role assignment to service principal" or "Add member to role*" operations initiated by a service principal. This detection is crucial for identifying potential bypasses of administrative consent processes, which could lead to unauthorized privilege grants. If malicious, this could allow attackers to exploit automation to assign sensitive permissions without proper oversight, compromising the security of the Azure AD environment.