Multiple Azure AD Admin Role Assignments
Detects when a single user principal name (UPN) performs two or more Azure AD admin role assignments within an hour. This could indicate an attempt to escalate privileges or establish persistence by assigning administrative roles to multiple accounts or to the same account multiple times.
Microsoft Sentinel (KQL)
