Identifying Rogue Azure Subscription Role Assignments and Privilege Escalation

Gaining unauthorized administrative control in an Azure tenant often culminates in modifying Role-Based Access Control (RBAC) assignments. When an attacker compromises an identity with Microsoft.Authorization/roleAssignments/write permissions, they grant Owner or User Access Administrator roles to backdoor accounts or managed identities.

This guide provides a production-ready KQL rule to alert on critical role assignments across all subscriptions.

Required Log Source

• AzureActivity logs enabled at the Tenant/Management Group root level and ingested into Microsoft Sentinel.

High-Fidelity KQL Detection Rule

// Alert on High-Privilege Role Assignments (Owner, Contributor, User Access Administrator)
let highPrivilegeRoles = dynamic([
    "8e3af657-a8ff-443c-a75c-2fe8c4bcb635", // Owner
    "b24988ac-6180-42a0-ab88-20f7382dd24c", // Contributor
    "18d7d88d-d35e-4fb5-a5f3-770238d74e41"  // User Access Administrator
]);
AzureActivity
| where TimeGenerated >= ago(24h)
| where OperationNameValue =~ "Microsoft.Authorization/roleAssignments/write"
| where ActivityStatusValue =~ "Success"
| extend PropertiesBag = parse_json(Properties)
| extend RoleDefinitionId = tostring(PropertiesBag.requestbody.Properties.RoleDefinitionId),
         PrincipalId = tostring(PropertiesBag.requestbody.Properties.PrincipalId),
         Scope = tostring(PropertiesBag.requestbody.Properties.Scope)
| where RoleDefinitionId in (highPrivilegeRoles) or RoleDefinitionId has_any (highPrivilegeRoles)
| project TimeGenerated, Caller, CallerIpAddress, SubscriptionId, Scope, PrincipalId, RoleDefinitionId, ActivitySubstatusValue
| order by TimeGenerated desc

Breakdown of Key Fields

• OperationNameValue: We target roleAssignments/write specifically upon ActivityStatusValue == "Success".
• Role GUID Filtering: Azure RBAC definitions rely on deterministic global GUIDs. Matching by GUID ensures language-agnostic detection regardless of portal localization.
• Caller: Identifies the principal (user, service principal, or managed identity) executing the privilege escalation.

Incident Response Steps

1. Determine whether the Caller used Privileged Identity Management (PIM) for just-in-time activation.
2. Verify with the subscription owner if this assignment matches an approved change ticket.
3. If unauthorized, immediately revoke the role assignment using az role assignment delete.

MITRE ATT&CK Mapping

• Tactic: Privilege Escalation (TA0004), Persistence (TA0003)
• Technique: Account Manipulation: Additional Cloud Roles (T1098.003)