Azure AD Audit Logs: User Added to Administrator Role

Flags Azure AD audit events where a user is added to an Admin/Administrator role.

FreeReviewedSigma · Medium · v5

Product: azure
Service: auditlogs
Author: Raphaël CALVET, @MetallicHack (SigmaHQ), DRL 1.1
Published: 2021-10-04
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Defense Evasion

Recon
Resource Dev
Initial Access
- T1078Valid Accounts
Execution
Persistence
- T1078Valid Accounts
- T1098.003Additional Cloud Roles
Priv Esc
- T1078Valid Accounts
- T1098.003Additional Cloud Roles
Defense Evasion
- T1078Valid Accounts
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches Azure AD audit log events where a user is added to a role with administrator-level scope by detecting the operation "Add member to role" and target role names containing "Admins" or "Administrator". Adding members to administrative roles grants elevated permissions and is a common persistence and privilege-escalation step for attackers. It relies on Azure audit log telemetry that includes operation name and target resource role names.

Reporting behind it

Related detections9 linkedT1078 — drag to rearrange

Suspicious Login Shell Assigned to Service Account games on Linux

Suspicious SSH Daemon Configuration Change Enabling Root Login

Suspicious Service Principal Creation via Azure Audit Logs

Suspicious NTLM Network Logon From Attacker Controlled Workstation Names (via security)

Suspicious dMSA Object Access with Migration AccessMask

Malicious IAM Group Creation for SES Abuse by JavaGhost (via cloudtrail)

Malicious Administrator Policy Attachment for Privilege Escalation in AWS

Suspicious Azure Contributor Role Assignment to Identity

Malicious ESX Admins Group Added to Privileged Directory Group

Azure AD Audit Logs: User Added to Administrator Role

Pivot detection · T1078 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

azure-ad-audit-logs-user-added-to-administrator-role-ebbeb024

title: "Azure AD Audit Logs: User Added to Administrator Role"
id: 64f31563-13a0-439b-ab9c-f9878ffdb3c0
status: test
description: This rule matches Azure AD audit log events where a user is added to a role with administrator-level scope by detecting the operation "Add member to role" and target role names containing "Admins" or "Administrator". Adding members to administrative roles grants elevated permissions and is a common persistence and privilege-escalation step for attackers. It relies on Azure audit log telemetry that includes operation name and target resource role names.
references:
  - https://web.archive.org/web/20250904191633/https://m365internals.com/2021/07/13/what-ive-learned-from-doing-a-year-of-cloud-forensics-in-azure-ad/
  - https://research.splunk.com/cloud/a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a/
  - https://analyticsrules.exchange/analyticrules/2a09f8cb-deb7-4c40-b08b-9137667f1c0b/
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_ad_user_added_to_admin_role.yml
author: Raphaël CALVET, @MetallicHack, Huntrule Team
date: 2021-10-04
modified: 2026-04-30
tags:
  - attack.initial-access
  - attack.persistence
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1098.003
  - attack.t1078
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName: Add member to role
    properties.targetResources|contains:
      - Admins
      - Administrator
  condition: selection
falsepositives:
  - PIM (Privileged Identity Management) generates this event each time 'eligible role' is enabled.
level: medium
license: DRL-1.1
related:
  - id: ebbeb024-5b1d-4e16-9c0c-917f86c708a7
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL