Entra guest promoted to member
A GUEST account was converted to a full MEMBER of the tenant (UserType Guest → Member).
What it detects
A GUEST account was converted to a full MEMBER of the tenant (UserType Guest → Member).
Guests are deliberately second-class: default directory permissions are restricted, they are excluded from many Conditional Access and sharing policies, and access reviews and B2B expiry are built around them. Flipping UserType to Member removes all of that in one property change. The account keeps its external identity and its external mailbox — an attacker who got a guest invitation accepted, or who compromised a partner's account, promotes it and inherits ordinary employee reach without creating any new account for a joiner-leaver report to notice.
It is a single, quiet property edit on an operation (Update user) that a tenant produces constantly for phone numbers and job titles, which is why a rule on the operation alone is useless and this one keys on the changed property.
MITRE ATT&CK mapping
False positives and triage
There is a legitimate version: a contractor or an acquired-company employee becomes staff and IT converts the account rather than recreating it. That is a real workflow, so treat this as a lead rather than a verdict.
Escalate on: a promotion performed by an account that does not normally manage users, a target whose UPN is still an external identity (#EXT#, a consumer domain) with no corresponding HR change, a promotion shortly after the guest first signed in, or one followed by role or group additions for the same target. Check who INVITED the guest originally — a self-invited or recently-invited guest that gets promoted within days is the pattern worth chasing.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 65%. Source: rules/cloud/entra_guest_promoted_to_member.yaml, licensed under the Apache License 2.0.
id: cloud.identity.entra_guest_promoted_to_member
version: 1.0.0
status: stable
severity: high
confidence: 0.65
platforms: [application]
mitre_techniques: [T1098, T1078.004]
description: |
A GUEST account was converted to a full MEMBER of the tenant (`UserType`
Guest → Member).
Guests are deliberately second-class: default directory permissions are
restricted, they are excluded from many Conditional Access and sharing
policies, and access reviews and B2B expiry are built around them. Flipping
UserType to Member removes all of that in one property change. The account
keeps its external identity and its external mailbox — an attacker who got a
guest invitation accepted, or who compromised a partner's account, promotes it
and inherits ordinary employee reach without creating any new account for a
joiner-leaver report to notice.
It is a single, quiet property edit on an operation (`Update user`) that a
tenant produces constantly for phone numbers and job titles, which is why a
rule on the operation alone is useless and this one keys on the changed
property.
match:
provider_any: [AzureAD, Office365]
event_action_contains_any:
- "Update user"
# `UserType=Member` ALONE is not the signal, and matching it was wrong: every
# `Update user.` record carries `additionalDetails: {"UserType":"Member"}`
# describing the ACTOR, so that predicate fired on MFA registrations, PIM
# activations, consent grants and password resets across the corpus. The
# promotion is only real when UserType is in Entra's CHANGED-property list, so
# require the new value and the explicit "this property was updated" marker.
raw_message_regex: "UserType=Member.*Included Updated Properties=UserType"
correlation_keys: [user_name, target_user_name]
false_positive_guidance: |
There is a legitimate version: a contractor or an acquired-company employee
becomes staff and IT converts the account rather than recreating it. That is a
real workflow, so treat this as a lead rather than a verdict.
Escalate on: a promotion performed by an account that does not normally manage
users, a target whose UPN is still an external identity (`#EXT#`, a consumer
domain) with no corresponding HR change, a promotion shortly after the guest
first signed in, or one followed by role or group additions for the same
target. Check who INVITED the guest originally — a self-invited or
recently-invited guest that gets promoted within days is the pattern worth
chasing.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.