Suspicious App Assigned To Azure RBAC/Microsoft Entra Role (via auditlogs)

title: Suspicious App Assigned To Azure RBAC/Microsoft Entra Role (via auditlogs)
id: 53ba1258-392d-5791-a969-deae79ab6ab7
status: stable
description: This rule detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.
references:
    - https://attack.mitre.org/techniques/T1098/003/
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#service-principal-assigned-to-a-role
author: Huntrule Team
date: 2026-07-27
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1098.003
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        targetResources.type: 'Service Principal'
        properties.message:
            - Add member to role
            - Add eligible member to role
            - Add scoped member to role
    condition: selection
falsepositives:
    - Unknown
level: medium