Azure Audit Logs: Service Principal Assigned Azure RBAC/Microsoft Entra Roles

Finds Azure role assignments where an app/service principal is granted, eligible, or scoped membership via audit log messages.

FreeUnreviewedSigmamediumv1

azure-audit-logs-service-principal-assigned-azure-rbac-microsoft-entra-roles-b04934b2

title: "Azure Audit Logs: Service Principal Assigned Azure RBAC/Microsoft Entra Roles"
id: 8a809790-eae9-4330-bf2a-c8fdd2a26fe5
status: test
description: This rule identifies events where a service principal (app) is added as a member, eligible member, or scoped member to an Azure role. Such role assignments can grant elevated privileges and enable persistent access, including for privilege escalation scenarios. The detection relies on Azure audit log messages indicating role membership changes for service principals.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#service-principal-assigned-to-a-role
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_app_role_added.yml
author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule Team
date: 2022-07-19
modified: 2024-11-04
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098.003
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    targetResources.type: Service Principal
    properties.message:
      - Add member to role
      - Add eligible member to role
      - Add scoped member to role
  condition: selection
falsepositives:
  - When the permission is legitimately needed for the app
level: medium
license: DRL-1.1
related:
  - id: b04934b2-0a68-4845-8a19-bdfed3a68a7a
    type: derived

What it detects

This rule identifies events where a service principal (app) is added as a member, eligible member, or scoped member to an Azure role. Such role assignments can grant elevated privileges and enable persistent access, including for privilege escalation scenarios. The detection relies on Azure audit log messages indicating role membership changes for service principals.

Known false positives

When the permission is legitimately needed for the app

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.