Service Principal Self-Assignment to Directory Role
Detects an application or service principal adding itself to a privileged directory role (such as Global Administrator) via Microsoft Entra audit logs, where no prior self-assignment by that principal to that role occurred in the previous 7 days.
Microsoft Sentinel (KQL)
