High Volume of Azure Access Control or Role Operations by Single Caller

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•10

This rule detects an unusually high volume (10 or more within an hour) of successful access control or role-related operations initiated by a single caller in Azure Activity logs. Such activity could indicate an adversary attempting to enumerate permissions, escalate privileges, or modify access to resources within an Azure environment.