Azure AD Guest User Type Changed To Member

The following analytic detects when an Azure AD guest user account has its UserType property changed from Guest to Member. It leverages Azure Active Directory AuditLogs for the "Update user" operation and compares the UserType modifiedProperty old and new values. A legacy account whose UserType was null is not a guest promotion and does not match. Guest accounts carry inherent restrictions on tenant resource access; elevating to Member removes those restrictions. If confirmed malicious, this activity indicates an attacker is expanding the capabilities of a compromised or attacker-controlled guest account to gain broader access to tenant resources.