[Entra ID] Mass Privileged Role Change Activity Detected

Original query, unchanged.

AuditLogs
| where Category =~ "RoleManagement"
| where ActivityDisplayName has_any ("Add eligible member to role", "Add member to role")
| mv-expand TargetResources
| mv-expand TargetResources.modifiedProperties
| extend displayName_ = tostring(TargetResources_modifiedProperties.displayName)
| extend RoleName = tostring(parse_json(tostring(TargetResources_modifiedProperties.newValue)))
| extend InitiatingAppServicePrincipalName = tostring(InitiatedBy.app.servicePrincipalName)
| where RoleName contains "Admin"
| extend Target = tostring(TargetResources.userPrincipalName)
| summarize dcount(Target) by bin(TimeGenerated, 1h)
| where dcount_Target >= 9
| join kind=rightsemi  (AuditLogs
    | where Category =~ "RoleManagement"
    | where ActivityDisplayName has_any ("Add eligible member to role", "Add member to role")
    | mv-expand TargetResources
    | mv-expand TargetResources.modifiedProperties
    | extend displayName_ = tostring(TargetResources_modifiedProperties.displayName)
    | where displayName_ =~ "Role.DisplayName"
    | extend RoleName = tostring(parse_json(tostring(TargetResources_modifiedProperties.newValue)))
    | extend InitiatingAppServicePrincipalId = tostring(InitiatedBy.app.servicePrincipalId)
    | extend Source_UserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)
    | extend InitiatingAppName = tostring(InitiatedBy.app.displayName)
    | where RoleName contains "Admin"
    | extend Target = tostring(TargetResources.userPrincipalName)
    | extend InitiatingIpAddress = tostring(iff(isnotempty(InitiatedBy.user.ipAddress), InitiatedBy.user.ipAddress, InitiatedBy.app.ipAddress))
    | extend Source_Network_IPLocation = ""
    | extend TimeWindow = bin(TimeGenerated, 1h))
    on $left.TimeGenerated == $right.TimeWindow
| project
        Alert_Category_en = "Entra ID",
    Alert_SubCategory_en = "Anomaly Identity Privilege Modification",
    Alert_Name_en = "Mass Privileged Role Change Activity Detected",
    Alert_Description_en =  strcat(
                            "At Taiwan time: ",
                            format_datetime(datetime_utc_to_local(TimeGenerated, "Asia/Taipei"), "yyyy-MM-dd HH:mm:ss"),
                            "in the Microsoft Entra ID tenant"
    ", user:  ",
                            iff(isnotempty(Source_UserPrincipalName), Source_UserPrincipalName, InitiatingAppName),
                            " at IP: ",
                            InitiatingIpAddress,
                            ", performed mass permission changes. Newly added role permission: ",
                            RoleName
                        ),
    Alert_TriageStep_en=
    strcat(
    "1. Confirm whether the high-privilege role assignment  ",
    iff(isnotempty(RoleName), RoleName, "<NoRole>"),
    "  has a corresponding change request or approval record.",
    "2. Verify whether target account  ",
    iff(isnotempty(Target), Target, "<NoTargetUser>"),
    "  is a user who actually needs this administrative permission.",
    "3. Check whether source IP  ",
    iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, "<NoIP>"),
    "  and sign-in location  ",
    iff(isnotempty(Source_Network_IPLocation), Source_Network_IPLocation, "<NoLocation>"),
    "  are company IPs and commonly used locations."
),
    Alert_Containment_en = strcat(
                           "1. Immediately review and suspend all Admin role members added during the event time window, confirm whether they are approved permission changes, and immediately remove unauthorized roles.",
                           "2. Immediately restrict or disable the source account or application that performed the role assignment (",
                           iff(isnotempty(InitiatingAppName), InitiatingAppName, "<NoInitiator>"),
                           "), and revoke its existing sign-in tokens and sessions. ",
                           "3. If the source is a Service Principal, immediately disable the application, revoke credentials/secrets and Graph API permissions, and prevent continued automation abuse. "
                       ),
    Alert_Remediation_en = strcat(
                           "1. Strengthen Admin role assignment governance: allow Just-In-Time access only through PIM, require approval and access justification, and prohibit permanent assignments. ",
                           "2. Establish real-time alerts and automated response (SOAR) for role changes, including mass assignments, off-hours activity, or abnormal geolocation behavior.",
                           "3. Regularly audit Admin role members/Service Principal permissions and API consent, and remove unnecessary or long-unused high-privilege access. "
                       ),
            Alert_Time_TW = datetime_utc_to_local(TimeGenerated, "Asia/Taipei"),
    Alert_Time_UTC0 = TimeGenerated,
    Event_Action = ActivityDisplayName,
    Event_Status = Result,
    //Event_Description = ActivityDisplayName,
    Source_Identity_FullName = iff(isnotempty(Source_UserPrincipalName), Source_UserPrincipalName, InitiatingAppName),
    //Source_Identity_ID = ActorID,
    Source_Identity_Type = iff(isnotempty(Source_UserPrincipalName), "User", "Service"),
    Source_Network_IPAddress = InitiatingIpAddress,
    Source_Network_IPLocation = Source_Network_IPLocation,
    //Source_Resource_Name = InitiatingAppName,
    Target_Identity_FullName = Target,
    Target_Identity_DomainType = iff(Target contains "EXT", 'External', 'Internal'),
    Target_Identity_Type = "User",
    Target_Resource_ID = "",
    Target_Resource_Type = "Entra ID"