Identification of User Accounts with Assigned Administrative or Privileged Roles
This rule identifies user accounts that have one or more roles assigned to them. It queries the 'IdentityInfo' table, filters for entries where the 'AssignedRoles' field is not empty, and then projects relevant account details such as UPN, display name, assigned roles, and object ID. Finally, it summarizes the data to retrieve the most recent record for each unique account object ID.
Microsoft Sentinel (KQL)
