Azure AD Audit Logs: User Added to Administrator Role

title: "Azure AD Audit Logs: User Added to Administrator Role"
id: 64f31563-13a0-439b-ab9c-f9878ffdb3c0
status: test
description: This rule identifies Azure AD audit log events where a user is added as a member to an administrator role, matching operations named 'Add member to role' targeting resources containing 'Admins' or 'Administrator'. Granting administrator role membership is a high-impact step that can enable privilege escalation and persistent control if performed by an unauthorized actor. The detection relies on Azure audit log telemetry with the operation name and the targeted role names in the event payload.
references:
  - https://web.archive.org/web/20250904191633/https://m365internals.com/2021/07/13/what-ive-learned-from-doing-a-year-of-cloud-forensics-in-azure-ad/
  - https://research.splunk.com/cloud/a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a/
  - https://analyticsrules.exchange/analyticrules/2a09f8cb-deb7-4c40-b08b-9137667f1c0b/
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_ad_user_added_to_admin_role.yml
author: Raphaël CALVET, @MetallicHack, Huntrule Team
date: 2021-10-04
modified: 2026-04-30
tags:
  - attack.initial-access
  - attack.persistence
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1098.003
  - attack.t1078
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName: Add member to role
    properties.targetResources|contains:
      - Admins
      - Administrator
  condition: selection
falsepositives:
  - PIM (Privileged Identity Management) generates this event each time 'eligible role' is enabled.
level: medium
license: DRL-1.1
related:
  - id: ebbeb024-5b1d-4e16-9c0c-917f86c708a7
    type: derived