Azure User Elevated to User Access Administrator Role

Description

Detects when a user elevates their permissions to the "User Access Administrator" role in Azure, which grants full control over access management for Azure resources. The User Access Administrator role is one of the most powerful privileged roles in Azure, allowing the holder to manage user access to all Azure resources, assign roles to other users including administrative roles, and effectively control the entire Azure subscription's permission structure.

Query · python

def rule(event):

    operation_name = event.get("operationName", "")
    result = event.get("result", "").lower()
    return all(
        [
            "User has elevated their access to User Access Administrator" in operation_name,
            result == "success",
        ]
    )


def title(event):
    actor = event.deep_get(
        "properties", "initiatedBy", "user", "userPrincipalName", default="<UNKNOWN_ACTOR>"
    )

    return f"User Elevated to User Access Administrator Role: [{actor}]"


def alert_context(event):
    context = {}

    context["tenantId"] = event.get("tenantId", "<NO_TENANTID>")
    context["operation_name"] = event.get("operationName", "<NO_OPERATION>")
    context["category"] = event.get("category", "<NO_CATEGORY>")
    context["result"] = event.get("result", "<NO_RESULT>")

    # Initiator details
    context["initiator_user_id"] = event.deep_get(
        "properties", "initiatedBy", "user", "id", default="<NO_USER_ID>"
    )
    context["initiator_display_name"] = event.deep_get(
        "properties", "initiatedBy", "user", "displayName", default="<NO_DISPLAY_NAME>"
    )
    context["initiator_ip"] = event.deep_get(
        "properties", "initiatedBy", "user", "ipAddress", default="<NO_IP>"
    )

    return context

Analyst notes

  1. Query Azure.Audit logs for all role assignment operations and permission changes by properties:initiatedBy:user:userPrincipalName in the 24 hours after the elevation to identify what privileged actions the user performed with the elevated access
  2. Verify with the user or their manager whether this elevation was authorized and required for a specific operational task, incident response activity, or break-glass scenario documented in your organization's procedures
  3. Review Azure.Audit logs for role assignments made during the elevated access period to identify if the user granted themselves or others persistent administrative roles that should be revoked, and check if the User Access Administrator role was properly removed after the task completion
Raw source Azure User Elevated to User Access Administrator Role · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: azure_elevate_user_access_admin.py
RuleID: "Azure.Audit.ElevateUserAccessAdministrator"
DisplayName: "Azure User Elevated to User Access Administrator Role"
Enabled: true
LogTypes:
  - Azure.Audit
Severity: High
Description: >
  Detects when a user elevates their permissions to the "User Access Administrator" role in Azure,
  which grants full control over access management for Azure resources. The User Access Administrator
  role is one of the most powerful privileged roles in Azure, allowing the holder to manage user access
  to all Azure resources, assign roles to other users including administrative roles, and effectively
  control the entire Azure subscription's permission structure.
Tags:
  - Persistence
  - Account Manipulation
Reports:
  MITRE ATT&CK:
    - TA0004:T1098
    - TA0004:T1098.003
Runbook: |
  1. Query Azure.Audit logs for all role assignment operations and permission changes by properties:initiatedBy:user:userPrincipalName in the 24 hours after the elevation to identify what privileged actions the user performed with the elevated access
  2. Verify with the user or their manager whether this elevation was authorized and required for a specific operational task, incident response activity, or break-glass scenario documented in your organization's procedures
  3. Review Azure.Audit logs for role assignments made during the elevated access period to identify if the user granted themselves or others persistent administrative roles that should be revoked, and check if the User Access Administrator role was properly removed after the task completion
Reference: https://github.com/elastic/detection-rules/blob/main/rules/integrations/azure/privilege_escalation_entra_id_elevate_to_user_administrator_access.toml
SummaryAttributes:
  - properties:initiatedBy:user:userPrincipalName
  - properties:initiatedBy:user:ipAddress
  - tenantId
Tests:
  - Name: User Elevated to User Access Administrator
    ExpectedResult: true
    Log:
      {
        "time": "2025-01-15 08:45:30.123",
        "resourceId": "/subscriptions/sub-123/providers/Microsoft.Authorization",
        "operationName": "User has elevated their access to User Access Administrator for their Azure Resources",
        "operationVersion": "1.0",
        "category": "AuditLogs",
        "tenantId": "tenant-123",
        "durationMs": 0,
        "callerIpAddress": "2.2.2.2",
        "correlationId": "elevate-access-001",
        "Level": "4",
        "properties":
          {
            "activityDateTime": "2025-01-15T08:45:30.1234567Z",
            "loggedByService": "Microsoft.Authorization",
            "operationType": "Assign",
            "initiatedBy":
              {
                "user":
                  {
                    "id": "user-admin-789",
                    "displayName": "Senior Administrator",
                    "userPrincipalName": "denethor@lotr.com",
                    "ipAddress": "2.2.2.2",
                  },
              },
            "additionalDetails":
              [
                { "key": "Action", "value": "Microsoft.Authorization/elevateAccess/action" },
                { "key": "Scope", "value": "/subscriptions/sub-123" },
              ],
          },
        "result": "SUCCESS",
        "p_event_time": "2025-01-15 08:45:30.123",
        "p_log_type": "Azure.Audit",
      }
  - Name: Different Operation
    ExpectedResult: false
    Log:
      {
        "time": "2025-01-15 14:15:35.345",
        "resourceId": "/subscriptions/sub-def/providers/Microsoft.Authorization",
        "operationName": "Delete role assignment",
        "operationVersion": "1.0",
        "category": "AuditLogs",
        "tenantId": "tenant-def",
        "resultSignature": "None",
        "durationMs": 0,
        "callerIpAddress": "198.51.100.150",
        "correlationId": "role-remove-001",
        "Level": "4",
        "properties":
          {
            "result": "success",
            "operationName": "Delete role assignment",
            "activityDisplayName": "Remove role assignment",
            "activityDateTime": "2025-01-15T14:15:35.3456789Z",
            "loggedByService": "Microsoft.Authorization",
            "operationType": "Unassign",
            "initiatedBy":
              {
                "user":
                  {
                    "id": "user-security-777",
                    "displayName": "Security Admin",
                    "userPrincipalName": "secadmin@company.com",
                    "ipAddress": "198.51.100.150",
                  },
              },
            "targetResources":
              [
                {
                  "id": "user-former-888",
                  "displayName": "Former Employee",
                  "userPrincipalName": "former@company.com",
                  "type": "User",
                },
              ],
            "additionalDetails":
              [
                { "key": "RoleName", "value": "Reader" },
                { "key": "Scope", "value": "/subscriptions/sub-def" },
              ],
          },
        "p_event_time": "2025-01-15 14:15:35.345",
        "p_log_type": "Azure.Audit",
      }

# ------ paired body: azure_elevate_user_access_admin.py ------

def rule(event):

    operation_name = event.get("operationName", "")
    result = event.get("result", "").lower()
    return all(
        [
            "User has elevated their access to User Access Administrator" in operation_name,
            result == "success",
        ]
    )


def title(event):
    actor = event.deep_get(
        "properties", "initiatedBy", "user", "userPrincipalName", default="<UNKNOWN_ACTOR>"
    )

    return f"User Elevated to User Access Administrator Role: [{actor}]"


def alert_context(event):
    context = {}

    context["tenantId"] = event.get("tenantId", "<NO_TENANTID>")
    context["operation_name"] = event.get("operationName", "<NO_OPERATION>")
    context["category"] = event.get("category", "<NO_CATEGORY>")
    context["result"] = event.get("result", "<NO_RESULT>")

    # Initiator details
    context["initiator_user_id"] = event.deep_get(
        "properties", "initiatedBy", "user", "id", default="<NO_USER_ID>"
    )
    context["initiator_display_name"] = event.deep_get(
        "properties", "initiatedBy", "user", "displayName", default="<NO_DISPLAY_NAME>"
    )
    context["initiator_ip"] = event.deep_get(
        "properties", "initiatedBy", "user", "ipAddress", default="<NO_IP>"
    )

    return context

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.