Azure AD Privileged Role to User or Service Principal

Detects assignment of highly privileged directory roles in Azure AD, including Global Administrator and Privileged Role Administrator.

Microsoft Sentinel (KQL)