Azure Role Assignment Creation or Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•37

Identifies when a user grants permissions to another user on Azure resources. The rule specifically looks for the 'Microsoft.Authorization/roleAssignments/write' operation in Azure Activity Logs, which indicates a role assignment creation or modification. This can be an indicator of privilege escalation or persistence.