Title:Azure Subscription Permission Elevation Via AuditLogs Status:test Description:Detects when a user has been elevated to manage all Azure Subscriptions.
This change should be investigated immediately if it isn't planned.
This setting could allow an attacker access to Azure subscriptions in your environment.
References: -https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#assignment-and-elevation Author: Austin Songer @austinsonger Date: 2021-11-26 modified:2026-09-26 Tags:
-'attack.privilege-escalation'
-'attack.persistence'
-'attack.initial-access'
-'attack.stealth'
-'attack.t1078'
Logsource:
product: azure
service: auditlogs
Detection: selection: Category:
'AzureRBACRoleManagementElevateAccess' ActivityDisplayName:
'User has elevated their access to User Access Administrator for their Azure Resources' condition:selection Falsepositives:
-If this was approved by System Administrator. Level:high
