Azure AD Privileged Graph API Permission Assigned

The analytic detects the assignment of high-risk Graph API permissions in Azure AD, specifically Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, and RoleManagement.ReadWrite.Directory. It scans Azure AD AuditLogs for 'Update application' operations, identifying when these permissions are assigned. This activity grants broad control over Azure AD, including application and directory settings. If malicious, it could lead to unauthorized modifications and potential security breaches, compromising the integrity and security of the Azure AD environment. Immediate investigation is required.