Azure AD Global Administrator Role Assigned

name: Azure AD Global Administrator Role Assigned
id: 825fed20-309d-4fd1-8aaf-cd49c1bb093c
version: 15
creation_date: '2022-08-17'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the assignment of the Azure AD Global Administrator role to a user. It leverages Azure Active Directory AuditLogs to identify when the "Add member to role" operation includes the "Global Administrator" role. This activity is significant because the Global Administrator role grants extensive access to data, resources, and settings, similar to a Domain Administrator in traditional AD environments. If confirmed malicious, this could allow an attacker to establish persistence, escalate privileges, and potentially gain control over Azure resources, posing a severe security risk.
data_source:
    - Azure Active Directory Add member to role
search: |-
    `azure_monitor_aad` operationName="Add member to role" properties.targetResources{}.modifiedProperties{}.newValue="*Global Administrator*"
      | rename properties.* as *
      | rename initiatedBy.user.userPrincipalName as initiatedBy
      | rename userAgent as user_agent
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product user_agent
           initiatedBy signature
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_global_administrator_role_assigned_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLogs log category.
known_false_positives: Administrators may legitimately assign the Global Administrator role to a user. Filter as needed.
references:
    - https://o365blog.com/post/admin/
    - https://adsecurity.org/?p=4277
    - https://www.mandiant.com/resources/detecting-microsoft-365-azure-active-directory-backdoors
    - https://docs.microsoft.com/en-us/azure/active-directory/roles/security-planning
    - https://docs.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin
    - https://attack.mitre.org/techniques/T1098/003/
drilldown_searches:
    - name: View the detection results for - "$user$"
      search: '%original_detection_search% | search  user = "$user$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$user$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
finding:
    title: Global Administrator Role assigned for User $user$ initiated by $initiatedBy$
    entity:
        field: initiatedBy
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 50
          message: Global Administrator Role assigned for User $user$ initiated by $initiatedBy$
analytic_story:
    - Azure Active Directory Persistence
    - Azure Active Directory Privilege Escalation
    - Scattered Lapsus$ Hunters
asset_type: Azure Active Directory
mitre_attack_id:
    - T1098.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_assign_global_administrator/azure-audit.log
          source: Azure AD
          sourcetype: azure:monitor:aad
      test_type: unit