Azure AD Role Enumeration (T1087.004)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•9•0•13

Correlates the execution of commands or Graph calls attempting to list Global Administrators or highly privileged roles within the tenant, specifically looking for 'List directory roles' actions combined with Azure AD sign-in events from non-corporate IP addresses.