High-Privilege Graph Permission Grant to Agent Service Principal
This rule detects when an application role assignment or delegated permission grant is successfully added to a service principal in Azure Active Directory, specifically looking for highly privileged permissions such as 'RoleManagement.ReadWrite.Directory', 'UserAuthenticationMethod.ReadWrite.All', 'UserAuthMethod-TAP.ReadWrite.All', or 'User.Read.All'. This could indicate an adversary attempting to gain elevated access or persistence within the Azure AD environment.
Microsoft Sentinel (KQL)
