Entra ID role adds in the last 7 days

id: d7f6e5c4-b3a2-4e9f-8d7c-6a5b4c3d2e1f
name: Entra ID role adds in the last 7 days
description: |
  This query looks for Entra ID role adds identified by Microsoft Defender for Cloud Apps. It will require an corresponding app connector in Microsoft Defender for Cloud Apps.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
- Privilege Escalation
relevantTechniques:
- T1548
query: >
  let LookBack = 7d;
  CloudAppEvents
  | where ActionType in ("Add member to role.") and Timestamp > ago(LookBack)
  | extend FirstElement = ActivityObjects[0], SecondElement = ActivityObjects[1], ThirdElement = ActivityObjects[2]
  | extend Type = FirstElement.ServiceObjectType
  | extend RoleName = FirstElement.Name
  | extend UserAddedName = SecondElement.Name 
  | extend UserAddedObjectId = SecondElement.Id
  | project Timestamp,Type,ActionType,RoleName,UserAddedName,UserAddedObjectId,PerformedByObjectId = AccountId,PerformedByDisplayName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: DisplayName
        columnName: UserAddedName
      - identifier: ObjectGuid
        columnName: UserAddedObjectId
      - identifier: ObjectGuid
        columnName: PerformedByObjectId
      - identifier: DisplayName
        columnName: PerformedByDisplayName
version: 1.0.0