Suspicious App Role Assignment Activity

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•8

This rule detects suspicious activity related to the assignment of application roles. Specifically, it identifies when a single user principal name (UPN) performs 10 or more successful 'Add app role assignment' operations within a one-hour window. This could indicate an attacker rapidly granting themselves or other entities access to multiple applications or resources.