Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Entra Admin Roles Query

Steven Lim@KQLWizard

•updated Jul 1, 2025•4•0•84

KQL Query from file: Entra Admin Roles Query

Microsoft Sentinel (KQL)

Tags

T1078 - Valid Accounts T1078.004 - Cloud Accounts T1087 - Account Discovery TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0007 - Discovery DS0026 - Active Directory M1015 - Active Directory Configuration S0684 - ROADTools T1556.007 - Hybrid Identity T1098.005 - Device Registration T1055.011 - Extra Window Memory Injection T1591.004 - Identify Roles G0018 - admin@338 T1098.003 - Additional Cloud Roles T1047 - Windows Management Instrumentation M1018 - User Account Management T1021.006 - Windows Remote Management TA0006 - Credential Access TA0043 - Reconnaissance TA0002 - Execution TA0008 - Lateral Movement Admin Activity Cloud Api Call User Account Modified Azure Office 365 Azure Signin Logs Azure Ad Risk Detection M365 Unified Audit Logkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?