Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Multiple Entra ID Admin Removals

Azure Sentinel@AzureSentinel

•updated Jun 17, 2025•3•1•91

Looks for multiple users that had their admin role removed by a single user within a certain period.

Microsoft Sentinel (KQL)

Tags

TA0003 - Persistence T1098 - Account Manipulation TA0004 - Privilege Escalation T1078.004 - Cloud Accounts T1586.003 - Cloud Accounts T1585.003 - Cloud Accounts TA0005 - Defense Evasion TA0001 - Initial Access TA0042 - Resource Development T1556.007 - Hybrid Identity T1098.005 - Device Registration T1055.011 - Extra Window Memory Injection enterprise-attack - Enterprise ATT&CK T1526 - Cloud Service Discovery T1651 - Cloud Administration Command T1675 - ESXi Administration Command T1609 - Container Administration Command T1066 - Indicator Removal from Tools T1027.005 - Indicator Removal from Tools G1003 - Ember Bear TA0006 - Credential Access TA0007 - Discovery TA0002 - Execution Admin Activity User Account Modified Azure Office 365 Microsoft Exchange Server M365 Unified Audit Logkqltactic:Persistence

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?