Unauthorized Member Action on RiskyUsers in Azure Entra ID

Igor Oliveira@Pr0fiLeRR

•updated Feb 28, 2026•1•0•35

Detects actions performed on RiskyUsers in Azure Entra ID by unauthorized members. Specifically looks for CA or GA accounts performing IdentityProtection actions where the admin is not from the Information Security department. Note: String parsing (AdminLocalPart, AdminLastName, StrippedAdminName), fallback identity matching, summarize arg_max, and project are handled natively in KQL post-conversion.