↳ GitHub sourceAnalytics ruleHigh

Azure RBAC (Elevate Access)

Description

'Detects when a Global Administrator elevates access to all subscriptions and management groups in a tenant. When a Global Administrator elevates access they are assigned the User Access Administrator role at root scope. This Microsoft Sentinel Analytic Rule monitors who has elevated access in your tenant so that admins can take appropriate action. [Learn more](https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin?tabs=azure-portal)'

Rule type: Scheduled
Version: 1.0.0
Query frequency: 2h
Query period: 2h
Trigger: GreaterThan 0

Declared MITRE coverage

PrivilegeEscalation T1078

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

AzureActiveDirectory

Data types

AuditLogs

KQL query

Original query, unchanged.

AuditLogs
| where Category =~ "AzureRBACRoleManagementElevateAccess"
| where ActivityDisplayName =~ "User has elevated their access to User Access Administrator for their Azure Resources"
| extend Actor = tostring(InitiatedBy.user.userPrincipalName)
| extend IPAddress = tostring(InitiatedBy.user.ipAddress) 
| project
    TimeGenerated,
    Actor,
    OperationName,
    IPAddress,
    Result,
    LoggedByService

Declared entities

AccountIP

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Microsoft Entra ID/Analytic Rules/AzureRBAC.yaml ↗
Commit: 9800e51 ↗
Source identifier: 132fdff4-c044-4855-a390-c1b71e0f833b

Additional source files 2

Solutions/Microsoft Entra ID/Analytic Rules/AzureRBAC.yamlsource ↗Solutions/Microsoft Entra ID/Data/Solution_AAD.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.