Azure audit logs: Delegated permissions granted for all users

title: "Azure audit logs: Delegated permissions granted for all users"
id: c6f04111-e7c4-49c2-978d-b670cdd977e8
status: test
description: This rule flags events where an application receives delegated permission grants that apply to all users. Granting broad delegated access is risky because it can allow privileged operations without per-user consent, expanding the impact of stolen or misused app credentials. It relies on Azure audit log entries matching the message indicating a delegated permission grant.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_app_delegated_permissions_all_users.yml
author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule Team
date: 2022-07-28
tags:
  - attack.credential-access
  - attack.t1528
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message: Add delegated permission grant
  condition: selection
falsepositives:
  - When the permission is legitimately needed for the app
level: high
license: DRL-1.1
related:
  - id: a6355fbe-f36f-45d8-8efc-ab42465cbc52
    type: derived