Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Monthly Report Entra Eligible Role Activation

Steven Lim@KQLWizard

•updated Jul 1, 2025•2•0•38

KQL Query from file: Monthly Report Entra Eligible Role Activation

Microsoft Sentinel (KQL)

Tags

T1078 - Valid Accounts T1087 - Account Discovery T1098 - Account Manipulation TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0007 - Discovery M1026 - Privileged Account Management M1018 - User Account Management T1591.004 - Identify Roles T1098.003 - Additional Cloud Roles T1114.003 - Email Forwarding Rule T1556.007 - Hybrid Identity TA0043 - Reconnaissance TA0009 - Collection TA0006 - Credential Access Admin Activity User Account Modified Authentication Success Azure Office 365 Azure Activity Logs Azure Signin Logs Azure Monitor Logs M365 Unified Audit Logkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?