User Added to Azure AD Global or Device Admin Role

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•22

This rule monitors and alerts when a user is added to the 'Global Administrator' or 'Device Administrator' roles within Azure Active Directory. These roles grant highly elevated privileges, making this activity critical for detecting potential persistence, privilege escalation, or initial access attempts by adversaries. The detection logic specifically looks for 'Add member to role' operations within the RoleManagement category, targeting the unique identifiers for these two sensitive administrative roles.