Entra ID Privileged Role Assigned to Another Account

  1[metadata]
  2creation_date = "2026/10/19"
  3integration = ["azure"]
  4maturity = "production"
  5updated_date = "2026/10/19"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies when a privileged Microsoft Entra ID directory role is assigned from one account to a different account. The
 11actor can be a user or an application (service principal), and the member can be a user or a service principal. Privileged
 12roles can be used to take over the tenant, reset credentials, add credentials to applications, or control mail and
 13collaboration services, so an unexpected assignment is a strong persistence and privilege escalation signal. Adversaries
 14that compromise an administrator or a vendor application may grant a privileged role to an account they control.
 15"""
 16false_positives = [
 17    """
 18    Planned role assignments by administrators during onboarding, role changes, or delegation. Validate against the
 19    change record, and add exceptions for the administrators or automation accounts that routinely assign roles.
 20    """,
 21    """
 22    Identity governance and provisioning tools that assign directory roles on behalf of administrators. Review the
 23    initiating application and exclude it by application ID after review.
 24    """,
 25]
 26from = "now-9m"
 27language = "esql"
 28license = "Elastic License v2"
 29name = "Entra ID Privileged Role Assigned to Another Account"
 30note = """## Triage and analysis
 31
 32### Investigating Entra ID Privileged Role Assigned to Another Account
 33
 34This rule fires when a user or application assigns a privileged Entra ID directory role to a different user or service
 35principal. The privileged role list is exact: roles Microsoft marks as privileged plus other built-in roles with
 36administrative control over major services. Because role assignment is normal administrator work, treat the alert as a
 37prompt to confirm the assignment was expected.
 38
 39The rule evaluates the same operations as the application self-assignment rule: direct assignments and the PIM assignment
 40operations. The "outside of PIM" operation is a PIM alert that records only the role, not the member, so it is not
 41evaluated; the direct assignment it accompanies is.
 42
 43#### Possible investigation steps
 44
 45- Identify who assigned the role (`Esql.actor_id`, with `azure.auditlogs.properties.initiated_by.user.userPrincipalName` or `azure.auditlogs.properties.initiated_by.app.displayName`), who received it (`Esql.member_id` and `Esql.member_type`), and the role (`Esql.role_name`).
 46- Confirm the assignment against a change request, ticket, or the administrator's expected duties. Note the source address in `azure.auditlogs.properties.initiated_by.user.ipAddress` for user actors.
 47- If the actor is an application, review its service principal sign-ins for unexpected source addresses or user agents, and recent credential changes to the application.
 48- If the member is newly created, a guest, or a service principal you do not recognize, treat the assignment as high risk. Review when the member was created and by whom.
 49- Review what the member did after receiving the role: sign-ins, directory changes, new credentials, consent grants, and mailbox or file access.
 50- Look for other privileged role assignments by the same actor around the same time.
 51
 52### False positive analysis
 53
 54- Planned administrator assignments and onboarding.
 55- Identity governance, provisioning, and delegation tooling that assigns roles on behalf of administrators.
 56
 57### Response and remediation
 58
 59- If the assignment is unauthorized, remove the role assignment, disable the receiving account, and revoke its sessions.
 60- Review and reset credentials of the actor if it appears compromised, and review any credentials, consent grants, and role assignments added since.
 61- Add exceptions for expected administrators and provisioning accounts to reduce noise.
 62"""
 63references = [
 64    "https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference",
 65    "https://trustedsec.com/blog/managing-privileged-roles-in-microsoft-entra-id-a-pragmatic-approach",
 66]
 67risk_score = 47
 68rule_id = "e953db0d-89ea-4696-b233-612250ee2a11"
 69severity = "medium"
 70tags = [
 71    "Domain: Cloud",
 72    "Domain: Identity",
 73    "Data Source: Azure",
 74    "Data Source: Microsoft Entra ID",
 75    "Data Source: Microsoft Entra ID Audit Logs",
 76    "Use Case: Identity and Access Audit",
 77    "Use Case: Threat Detection",
 78    "Tactic: Privilege Escalation",
 79    "Tactic: Persistence",
 80    "Resources: Investigation Guide",
 81    "Rule Type: ES|QL",
 82    "Platform: Entra ID",
 83    "Profile: Beta"
 84]
 85timestamp_override = "event.ingested"
 86type = "esql"
 87
 88query = '''
 89from logs-azure.auditlogs-* metadata _id, _version, _index
 90// role assignments, matching the same operations as the application self-assignment rule
 91| where data_stream.dataset == "azure.auditlogs"
 92  and azure.auditlogs.operation_name in (
 93    "Add member to role",
 94    "Add member to role outside of PIM (permanent)",
 95    "Add member to role in PIM completed (permanent)",
 96    "Add member to role in PIM completed (timebound)",
 97    "Add eligible member to role in PIM completed (permanent)",
 98    "Add eligible member to role in PIM completed (timebound)"
 99  )
100  and event.outcome in ("success", "Success")
101// the actor can be a user or an application
102| eval Esql.actor_id = coalesce(azure.auditlogs.properties.initiated_by.user.id, azure.auditlogs.properties.initiated_by.app.servicePrincipalId)
103| eval Esql.actor_type = case(azure.auditlogs.properties.initiated_by.user.id is not null, "user", "service_principal")
104// the member is the account among the first two targets; the position differs by operation, and the "outside of PIM"
105// operation is a PIM alert that records only the role, so it has no member and is dropped below
106| eval Esql.member_id = case(
107    `azure.auditlogs.properties.target_resources.0.type` in ("User", "ServicePrincipal", "Group"), `azure.auditlogs.properties.target_resources.0.id`,
108    `azure.auditlogs.properties.target_resources.1.type` in ("User", "ServicePrincipal", "Group"), `azure.auditlogs.properties.target_resources.1.id`,
109    null
110  )
111| eval Esql.member_type = case(
112    `azure.auditlogs.properties.target_resources.0.type` in ("User", "ServicePrincipal", "Group"), `azure.auditlogs.properties.target_resources.0.type`,
113    `azure.auditlogs.properties.target_resources.1.type` in ("User", "ServicePrincipal", "Group"), `azure.auditlogs.properties.target_resources.1.type`,
114    null
115  )
116// one account assigning the role to a different account; self-assignment by an application has its own rule
117| where Esql.actor_id is not null and Esql.member_id is not null and Esql.actor_id != Esql.member_id
118// the role name is in a modified property for direct assignments, or the display name of the role target otherwise
119| eval Esql.role_name_raw = coalesce(
120    case(`azure.auditlogs.properties.target_resources.0.modified_properties.0.display_name` == "Role.DisplayName", `azure.auditlogs.properties.target_resources.0.modified_properties.0.new_value`, null),
121    case(`azure.auditlogs.properties.target_resources.0.modified_properties.1.display_name` == "Role.DisplayName", `azure.auditlogs.properties.target_resources.0.modified_properties.1.new_value`, null),
122    case(`azure.auditlogs.properties.target_resources.0.modified_properties.2.display_name` == "Role.DisplayName", `azure.auditlogs.properties.target_resources.0.modified_properties.2.new_value`, null),
123    case(`azure.auditlogs.properties.target_resources.0.modified_properties.3.display_name` == "Role.DisplayName", `azure.auditlogs.properties.target_resources.0.modified_properties.3.new_value`, null),
124    case(`azure.auditlogs.properties.target_resources.0.type` == "Role", `azure.auditlogs.properties.target_resources.0.display_name`, null),
125    case(`azure.auditlogs.properties.target_resources.1.type` == "Role", `azure.auditlogs.properties.target_resources.1.display_name`, null)
126  )
127| eval Esql.role_name = replace(Esql.role_name_raw, "\"", "")
128// privileged roles: every built-in role marked PRIVILEGED in the Microsoft Entra built-in roles reference, plus other
129// built-in roles with administrative control over major Entra and Microsoft 365 services or access to tenant data.
130// Matched by exact role name, not by pattern.
131| where to_lower(Esql.role_name) in (
132    // marked PRIVILEGED by Microsoft
133    "agent id administrator", "ai administrator", "ai reader", "application administrator", "application developer",
134    "attribute provisioning administrator", "attribute provisioning reader", "authentication administrator",
135    "authentication extensibility administrator", "authentication extensibility password administrator",
136    "b2c ief keyset administrator", "cloud application administrator", "cloud device administrator",
137    "conditional access administrator", "directory writers", "domain name administrator",
138    "entra soc identity responder", "external identity provider administrator", "global administrator",
139    "global reader", "helpdesk administrator", "hybrid identity administrator", "identity governance administrator",
140    "intune administrator", "lifecycle workflows administrator", "partner tier1 support", "partner tier2 support",
141    "password administrator", "privileged authentication administrator", "privileged role administrator",
142    "security administrator", "security operator", "security reader", "tenant governance administrator",
143    "user administrator",
144    // not marked privileged by Microsoft, but with administrative control over major services
145    "attribute assignment administrator", "authentication policy administrator", "cloud app security administrator",
146    "compliance administrator", "directory synchronization accounts", "dynamics 365 administrator",
147    "exchange administrator", "external id user flow administrator", "global secure access administrator",
148    "groups administrator", "knowledge administrator", "microsoft 365 backup administrator",
149    "microsoft 365 migration administrator", "on premises directory sync account", "power platform administrator",
150    "sharepoint administrator", "skype for business administrator", "teams administrator",
151    "teams telephony administrator", "windows 365 administrator", "yammer administrator",
152    // additional roles: mailbox permissions, local administrator on joined devices (current and previous display
153    // name), delegated partner access to the tenant, and approval of Microsoft support access to customer data
154    "exchange recipient administrator", "azure ad joined device local administrator",
155    "microsoft entra joined device local administrator", "customer delegated admin relationship administrator",
156    "customer lockbox access approver", "entra customer lockbox approver",
157    // legacy display name of Global Administrator
158    "company administrator"
159  )
160| drop Esql.role_name_raw
161| keep @timestamp, Esql.*, azure.*, event.*, cloud.*, related.*, tags, source.*, agent.*, client.*, _id, _version, _index, data_stream.namespace
162'''
163
164[rule.investigation_fields]
165field_names = [
166    "Esql.actor_id",
167    "Esql.actor_type",
168    "Esql.member_id",
169    "Esql.member_type",
170    "Esql.role_name",
171    "azure.auditlogs.properties.initiated_by.user.userPrincipalName",
172    "azure.auditlogs.properties.initiated_by.app.displayName",
173    "azure.tenant_id",
174]
175
176[[rule.threat]]
177framework = "MITRE ATT&CK"
178
179[[rule.threat.technique]]
180id = "T1078"
181name = "Valid Accounts"
182reference = "https://attack.mitre.org/techniques/T1078/"
183
184[[rule.threat.technique.subtechnique]]
185id = "T1078.004"
186name = "Cloud Accounts"
187reference = "https://attack.mitre.org/techniques/T1078/004/"
188
189[[rule.threat.technique]]
190id = "T1098"
191name = "Account Manipulation"
192reference = "https://attack.mitre.org/techniques/T1098/"
193
194[[rule.threat.technique.subtechnique]]
195id = "T1098.003"
196name = "Additional Cloud Roles"
197reference = "https://attack.mitre.org/techniques/T1098/003/"
198
199[rule.threat.tactic]
200id = "TA0004"
201name = "Privilege Escalation"
202reference = "https://attack.mitre.org/tactics/TA0004/"
203
204[[rule.threat]]
205framework = "MITRE ATT&CK"
206
207[[rule.threat.technique]]
208id = "T1078"
209name = "Valid Accounts"
210reference = "https://attack.mitre.org/techniques/T1078/"
211
212[[rule.threat.technique.subtechnique]]
213id = "T1078.004"
214name = "Cloud Accounts"
215reference = "https://attack.mitre.org/techniques/T1078/004/"
216
217[[rule.threat.technique]]
218id = "T1098"
219name = "Account Manipulation"
220reference = "https://attack.mitre.org/techniques/T1098/"
221
222[[rule.threat.technique.subtechnique]]
223id = "T1098.003"
224name = "Additional Cloud Roles"
225reference = "https://attack.mitre.org/techniques/T1098/003/"
226
227[rule.threat.tactic]
228id = "TA0003"
229name = "Persistence"
230reference = "https://attack.mitre.org/tactics/TA0003/"