Post-Compromise Entra Directory Role Escalation Activity

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•3

This rule detects high-risk administrative operations in Azure Active Directory (such as role assignment, password resets, and account status changes) that occur within 3 hours of a user's sign-in. This pattern often indicates an account compromise followed by immediate privilege escalation or persistence establishment.