App Assigned To Azure RBAC/Microsoft Entra Role

SigmaHQ Detections@sigmaHQ

•updated Nov 20, 2024•0•19

Detects when an application (service principal) is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner. This activity can indicate privilege escalation or persistence by an attacker who has compromised an application.