Azure Audit Logs: User Added to Privileged Eligibility Role
Alerts on Azure audit log events indicating a user was added as an eligible or permanent member to a privileged role.
- Product
- azure
- Service
- auditlogs
- Author
- Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H' (SigmaHQ), DRL 1.1
- Published
- 2022-08-06
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches Azure audit log events where a user is added as an eligible member for a privileged role (permanent or eligible). Adding privileged role eligibility can be used by an attacker to establish persistence and gain elevated access when conditions allow. It relies on audit log messages indicating “Add eligible member (permanent)” or “Add eligible member (eligible)”.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Azure Audit Logs: User Added to Privileged Eligibility Role"
id: 2a2ad4ae-abff-42c9-9bba-4fc638efef37
status: test
description: This rule matches Azure audit log events where a user is added as an eligible member for a privileged role (permanent or eligible). Adding privileged role eligibility can be used by an attacker to establish persistence and gain elevated access when conditions allow. It relies on audit log messages indicating “Add eligible member (permanent)” or “Add eligible member (eligible)”.
references:
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_priviledged_role_assignment_add.yml
author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Huntrule Team
date: 2022-08-06
tags:
- attack.persistence
- attack.initial-access
- attack.privilege-escalation
- attack.stealth
- attack.t1078.004
logsource:
product: azure
service: auditlogs
detection:
selection:
properties.message:
- Add eligible member (permanent)
- Add eligible member (eligible)
condition: selection
falsepositives:
- Legtimate administrator actions of adding members from a role
level: high
license: DRL-1.1
related:
- id: 49a268a4-72f4-4e38-8a7b-885be690c5b5
type: derived