Vendors / Microsoft Corporation / Office 365 / Azure AD Role Assignment

Event type

Azure AD Role Assignment

Add Member to Role - Privilege Escalation

Records Azure Active Directory role assignment operations, particularly additions to privileged roles like Global Administrator, which represent privilege escalation and potential security risks

JSON 32 fields Low Generator

azuread role-assignment privilege-escalation identity critical-security

Preview Sample View Schema

CLI Install

meltr templates install microsoft

Overview

What this event covers

Captures Azure Active Directory role assignment operations where users are added to administrative roles. Global Administrator assignments are the highest risk as they grant complete control over the tenant. This event is critical for detecting privilege escalation attacks and unauthorized administrative access.

When generated

›Administrator assigns user to Azure AD administrative role
›New administrator account provisioned with elevated privileges
›Attacker escalates privileges via compromised admin account
›Emergency administrative access granted
›Privileged Identity Management (PIM) activation

Security relevance

Critical

Compliance

NIST 800-53 (AC-2, AC-6, IA-4) PCI-DSS (Requirement 7 - Least Privilege) SOX (Access Controls) ISO 27001 (A.9.2 - User Access Management) CIS Controls (5.4 - Restrict Administrator Privileges)

Frequency notes

Very low frequency under normal operations (1 event/hour baseline). Role assignments should be rare, planned, and approved. Off-hours activity is extremely suspicious (5x night multiplier, 4x weekend). Global Administrator assignments require immediate investigation. Rapid successive assignments or assignments to newly created accounts are high-priority alerts.

Resources

Docs and tools

Office 365 Management Activity API Schema official Azure AD Built-in Roles official Privileged Identity Management (PIM) official MITRE ATT&CK - Account Manipulation (T1098) reference Microsoft 365 Defender Native detection for suspicious role assignments and privilege escalation Azure AD PowerShell Query and manage Azure AD roles and assignments Azure Sentinel SIEM with built-in analytics for Azure AD privilege escalation

Generation

Configuration

Base frequency: 1 events/hour
Time patterns: business_hours night_hours
Business hours: 2.0x
Night hours: 5.0x
Weekend: 4.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

CreationTime

DateTime Required

Timestamp when the role assignment occurred

Source: now() | iso8601

Format ISO 8601

Example 2024-12-15T16:08:52Z

Id

String Required

Unique identifier for this audit record

Source: random_guid()

Format GUID

Example e7f8a9b0-c1d2-3e4f-5a6b-7c8d9e0f1a2b

Operation

String Required

Azure AD operation performed

Source: Static value 'Add member to role'

Example Add member to role

OrganizationId

String Required

Microsoft 365 tenant identifier

Source: Derived from organization domain

Format GUID

Example b4c5d6e7-8f9a-0b1c-2d3e-4f5a6b7c8d9e

RecordType

Integer Required

Office 365 audit log record type (8 = AzureActiveDirectory)

Source: Static value 8

Example 8

Values

8 AzureActiveDirectory - Azure AD events including role assignments

ResultStatus

String Required

Outcome of the role assignment operation

Source: random_choice(['Success', 'Success', 'Success', 'Failed'])

Example Success

Values

Success Role assignment completed successfully
Failed Role assignment failed (insufficient permissions or validation error)

UserKey

String Required

Unique identifier for the user who performed the role assignment

Source: registry.get_random_user().email

Example admin@contoso.com

UserType

Integer Required

Type of user performing the action

Source: random_choice([0, 2])

Example 2

Values

0 Regular user (unusual for role assignments)
2 Administrator (expected)

Workload

String Required

Office 365 service where the operation occurred

Source: Static value 'AzureActiveDirectory'

Example AzureActiveDirectory

UserId

String Required

User principal name of the administrator account

Source: registry.get_random_user().email

Format Email/UPN

Example admin@contoso.com

ClientIP

String Required

IP address from which the operation was performed

Source: random_choice([random_public_ip(), random_private_ip()])

Format IPv4

Example 203.0.113.92

ObjectId

String Required

Object identifier for the role assignment (User_GUID format)

Source: User_ prefix with random_guid()

Example User_a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d

Actor

Array Required

Array containing actor information (user performing the assignment)

Source: Array with user ID and hex identifier

Actor[].ID

String Required

Actor identifier (email or hex ID)

Source: User email or hex identifier

Example admin@contoso.com

Actor[].Type

Integer Required

Actor type identifier

Example 0

Values

0 User principal
5 Other identifier type

ActorContextId

String Required

Tenant context of the actor

Source: Derived from organization domain

Format GUID

Example b4c5d6e7-8f9a-0b1c-2d3e-4f5a6b7c8d9e

ActorIpAddress

String Required

IP address of the actor

Source: random_choice([random_public_ip(), random_private_ip()])

Format IPv4

Example 203.0.113.92

Target

Array Required

Array containing target user information (user receiving the role)

Source: Array with target user identifiers

Target[].ID

String Required

Target user identifier

Source: User email or User_GUID format

Example newadmin@contoso.com

Target[].Type

Integer Required

Target type identifier

Example 2

Values

2 User object
5 Other identifier type

ApplicationId

String Required

Application that facilitated the role assignment

Source: Known Azure AD application GUIDs

Format GUID

Example c44b4083-3bb0-49c1-b47d-974e53cbdf3c

Values

c44b4083-3bb0-49c1-b47d-974e53cbdf3c Azure AD PowerShell
00000002-0000-0000-c000-000000000000 Azure AD Graph API
00000003-0000-0000-c000-000000000000 Microsoft Graph

DeviceProperties

Array Required

Properties of the device used for the role assignment

Source: Array with browser, compliance, and management status

DeviceProperties[].Name

String Required

Property name (BrowserType, IsCompliant, IsManaged)

Example IsCompliant

DeviceProperties[].Value

String Required

Property value

Source: Context-specific values for device properties

Example True

ExtendedProperties

Array Required

Additional properties including user type and user agent

Source: Array with additional context

ModifiedProperties

Array Required

Role details including role name and template ID

Source: Array showing role assignment details

ModifiedProperties[].Name

String Required

Property name (Role.WellKnownObjectName, Role.DisplayName, Role.TemplateId, Role.ObjectID)

Example Role.DisplayName

ModifiedProperties[].NewValue

String Required

Role being assigned

Source: Azure AD role name or GUID

Example Global Administrator

Values

Global Administrator Highest privilege - complete tenant control (TemplateId: 62e90394-69f5-4237-9190-012177145e10)
User Administrator Manage users and groups (TemplateId: fe930be7-5e62-47db-91af-98c3a49a38b1)
Privileged Role Administrator Manage role assignments (TemplateId: e8611ab8-c189-46e8-94e1-60213ab1f814)
Security Administrator Manage security settings (TemplateId: 194ae4cb-b126-40b2-bd5b-6091b380977d)
Helpdesk Administrator Reset passwords for non-admins (TemplateId: 729827e3-9c14-49f7-bb1b-9608f156bbb8)

ModifiedProperties[].OldValue

String Required

Previous value (empty for new role assignments)

Source: Empty string

ExternalAccess

Boolean Required

Indicates if the operation was performed from outside the corporate network

Source: random_choice(['true', 'false', 'false']) - weighted toward internal

Example true

AzureActiveDirectoryEventType

Integer Required

Type of Azure AD event

Source: Static value 1

Example 1

UserAgent

String Required

Browser user agent string

Source: Random user agent string

Example Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36