Azure Global Admin Role Assigned via Graph API

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects when a global administrator role is assigned in Azure via the Graph API. It specifically looks for HTTP POST requests to 'graph.microsoft.com' with 'assignLicense' in the URI.