Azure AD: Application Owner Added via Audit Log Message
Detects when an application owner is added in Azure audit logs, granting additional permissions to modify app configuration.
- Product
- azure
- Service
- auditlogs
- Author
- Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' (SigmaHQ), DRL 1.1
- Published
- 2022-06-02
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags audit log events where an application owner is added, identified by the message text "Add owner to application". Granting an owner role can enable the new account to modify application configuration, increasing attacker persistence and privilege within the tenant. It relies on Azure audit log telemetry capturing the specific operation message for owner changes.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Azure AD: Application Owner Added via Audit Log Message"
id: 115f1187-0416-4620-9029-2c945563be47
status: test
description: This rule flags audit log events where an application owner is added, identified by the message text "Add owner to application". Granting an owner role can enable the new account to modify application configuration, increasing attacker persistence and privilege within the tenant. It relies on Azure audit log telemetry capturing the specific operation message for owner changes.
references:
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#new-owner
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_app_owner_added.yml
author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik', Huntrule Team
date: 2022-06-02
tags:
- attack.t1552
- attack.credential-access
logsource:
product: azure
service: auditlogs
detection:
selection:
properties.message: Add owner to application
condition: selection
falsepositives:
- When a new application owner is added by an administrator
level: medium
license: DRL-1.1
related:
- id: 74298991-9fc4-460e-a92e-511aa60baec1
type: derived