Azure Arc Machine Identity/RBAC Change after Local Activity

Aitor Fernández@aitorsbio

•updated Mar 25, 2026•21•0•355

This rule detects unusual modifications to Azure Arc machine identities or Role-Based Access Control (RBAC) assignments following local activity. It specifically looks for 'Write', 'Update', or 'Assign' operations on resources within the 'Microsoft.HybridCompute' resource provider where the properties include 'identity' or 'roleAssignment'. This could indicate an attempt to establish persistence or escalate privileges on hybrid machines.