High-Privilege Role Assigned in Azure AD
This rule detects when a high-privilege role is assigned to a user in Azure Active Directory. It specifically looks for 'Add member to role', 'Add eligible member to role', or 'Add scoped member to role' operations that successfully assign one of a predefined list of privileged roles (e.g., Global Administrator, Security Administrator, Application Administrator) to a user. This activity can indicate privilege escalation or unauthorized access within an Azure AD environment.
Microsoft Sentinel (KQL)
