Microsoft 365 admin role grant
A directory role member was added in Microsoft Entra ID / Microsoft 365 ("Add member to role").
What it detects
A directory role member was added in Microsoft Entra ID / Microsoft 365 ("Add member to role"). Granting a privileged cloud role (e.g. Global Administrator, Exchange Administrator, Privileged Role Administrator) is how an attacker cements control of a tenant after an initial compromise, and how privilege abuse shows up in the audit log.
Matches the same tenant change through BOTH export paths. The Microsoft 365 Unified Audit Log writes "Add member to role." with a trailing period; the Entra ID diagnostic audit log writes it without one, and PIM adds a suffix ("Add member to role outside of PIM (permanent)", "Add eligible member to role in PIM completed (permanent)"). Substring matching covers all of them, because which pipe delivered the record says nothing about whether the grant was hostile.
MITRE ATT&CK mapping
- T1098.003Account Manipulation: Additional Cloud Roles· Persistence
False positives and triage
Role assignments are a normal admin task. Correlate with a change ticket and the granting admin; a role add outside a known onboarding/change window, granting a high-privilege role (Global Administrator), or performed by a recently compromised account is the signal. Review the target and the role granted.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/cloud/m365_admin_role_grant.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_admin_role_grant
version: 1.1.0
status: stable
severity: high
confidence: 0.7
platforms: [application]
mitre_techniques: [T1098.003]
description: |
A directory role member was added in Microsoft Entra ID / Microsoft 365
("Add member to role"). Granting a privileged cloud role (e.g. Global
Administrator, Exchange Administrator, Privileged Role Administrator) is how an
attacker cements control of a tenant after an initial compromise, and how
privilege abuse shows up in the audit log.
Matches the same tenant change through BOTH export paths. The Microsoft 365
Unified Audit Log writes "Add member to role." with a trailing period; the Entra
ID diagnostic audit log writes it without one, and PIM adds a suffix
("Add member to role outside of PIM (permanent)", "Add eligible member to role
in PIM completed (permanent)"). Substring matching covers all of them, because
which pipe delivered the record says nothing about whether the grant was hostile.
match:
provider_any: [Office365, AzureAD]
event_action_contains_any:
- "Add member to role"
- "Add eligible member to role"
correlation_keys: [target_user_name]
false_positive_guidance: |
Role assignments are a normal admin task. Correlate with a change ticket and the
granting admin; a role add outside a known onboarding/change window, granting a
high-privilege role (Global Administrator), or performed by a recently
compromised account is the signal. Review the target and the role granted.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.