Entra custom role definition change
A directory role DEFINITION was created or changed — the permissions a role carries, rather than who holds it.
What it detects
A directory role DEFINITION was created or changed — the permissions a role carries, rather than who holds it.
The pack already alerts when someone is added to a privileged role, which is the visible move. Editing a role definition is the quiet one: a custom role with an innocuous name can be given directory-write permissions and then handed to an ordinary-looking account, and every membership report afterwards shows a user in a role nobody thinks to question. Reviews that check "who is a Global Admin" do not catch it, because the account never becomes one.
Role definitions change rarely and deliberately, so the base rate is low even in a large tenant.
MITRE ATT&CK mapping
False positives and triage
Tenants that practise least privilege genuinely author custom roles, usually in bursts while a delegation model is designed and then almost never again. Check what PERMISSIONS the definition gained rather than that it changed: a role scoped to a helpdesk task is routine, one granting application, role-management or directory-write permissions is the escalation path this rule exists for. Confirm the actor normally administers roles, and look for a membership assignment to that role shortly after — definition then assignment is the complete technique.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 65%. Source: rules/cloud/entra_custom_role_definition_change.yaml, licensed under the Apache License 2.0.
id: cloud.identity.entra_custom_role_definition_change
version: 1.0.0
status: stable
severity: high
confidence: 0.65
platforms: [application]
mitre_techniques: [T1098.003, T1078.004]
description: |
A directory role DEFINITION was created or changed — the permissions a role
carries, rather than who holds it.
The pack already alerts when someone is added to a privileged role, which is the
visible move. Editing a role definition is the quiet one: a custom role with an
innocuous name can be given directory-write permissions and then handed to an
ordinary-looking account, and every membership report afterwards shows a user in
a role nobody thinks to question. Reviews that check "who is a Global Admin" do
not catch it, because the account never becomes one.
Role definitions change rarely and deliberately, so the base rate is low even in
a large tenant.
match:
event_action_any:
- "Add role definition."
- "Update role definition."
- "Add custom role definition."
correlation_keys: [user_name]
false_positive_guidance: |
Tenants that practise least privilege genuinely author custom roles, usually in
bursts while a delegation model is designed and then almost never again. Check
what PERMISSIONS the definition gained rather than that it changed: a role scoped
to a helpdesk task is routine, one granting application, role-management or
directory-write permissions is the escalation path this rule exists for. Confirm
the actor normally administers roles, and look for a membership assignment to that
role shortly after — definition then assignment is the complete technique.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.