Azure Audit Logs: Admin adds privileged delegated or app role permissions to service principal

Alerts on Azure audit events where an admin grants app roles to a service principal, enabling privileged application access.

FreeUnreviewedSigmahighv1

azure-audit-logs-admin-adds-privileged-delegated-or-app-role-permissions-to-serv-5aecf3d5

title: "Azure Audit Logs: Admin adds privileged delegated or app role permissions to service principal"
id: 13e5be45-7dac-4cf7-aa57-335abee186cd
related:
  - id: ba2a7c80-027b-460f-92e2-57d113897dbc
    type: obsolete
  - id: 5aecf3d5-f8a0-48e7-99be-3a759df7358f
    type: derived
status: test
description: This rule flags audit log events where an administrator grants application permissions by adding an app role assignment to a service principal. Such changes can enable or expand OAuth/app capabilities, allowing an attacker or misconfigured identity to gain persistent, highly privileged access. The detection relies on Azure audit log entries that include the specific message indicating an app role assignment being added to the service principal.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_app_privileged_permissions.yml
author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule Team
date: 2022-07-28
modified: 2023-03-29
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098.003
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message: Add app role assignment to service principal
  condition: selection
falsepositives:
  - When the permission is legitimately needed for the app
level: high
license: DRL-1.1

What it detects

This rule flags audit log events where an administrator grants application permissions by adding an app role assignment to a service principal. Such changes can enable or expand OAuth/app capabilities, allowing an attacker or misconfigured identity to gain persistent, highly privileged access. The detection relies on Azure audit log entries that include the specific message indicating an app role assignment being added to the service principal.

Known false positives

When the permission is legitimately needed for the app

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.