Back
Id90bacdf4-e35b-47cb-92d1-29d8397eb4a0
Rulename[Entra ID] Application Assigned Administrator Permissions Immediately After Obtaining Role Management Permissions
DescriptionDetects an application receiving administrator permissions and then using them to assign a role. This pattern can indicate rapid privilege escalation through app consent abuse.
SeverityHigh
TacticsPersistence
PrivilegeEscalation
DefenseEvasion
InitialAccess
TechniquesT1078.004
T1098.003
Required data connectorsAzureActiveDirectory
KindScheduled
Query frequency1h
Query period2h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/eDCRule/Analytic%20Rules/%5BEntra%20ID%5D%20Application%20Assigned%20Administrator%20Permissions%20Immediately%20After%20Obtaining%20Role%20Management%20Permissions.yaml
Version1.0.0
Arm template90bacdf4-e35b-47cb-92d1-29d8397eb4a0.json
Deploy To Azure
let query_frequency = 1h;
let query_period = 2h;
AuditLogs
| where TimeGenerated > ago(query_period)
| where Category =~ "ApplicationManagement" and LoggedByService =~ "Core Directory"
| where OperationName =~ "Add app role assignment to service principal"
| mv-expand TargetResource = TargetResources
| mv-expand modifiedProperty = TargetResource["modifiedProperties"]
| where tostring(modifiedProperty["displayName"]) == "AppRole.Value"
| extend PermissionGrant = tostring(modifiedProperty["newValue"])
| where PermissionGrant has "RoleManagement.ReadWrite.Directory"
| mv-apply modifiedProperty = TargetResource["modifiedProperties"] on (
    summarize modifiedProperties = make_bag(
                                   bag_pack(
    tostring(modifiedProperty["displayName"]),
    bag_pack(
    "oldValue",
    trim(@'[\"\s]+', tostring(modifiedProperty["oldValue"])),
    "newValue",
    trim(@'[\"\s]+', tostring(modifiedProperty["newValue"]))
)
),
                                   100
                               )
    )
| project
    PermissionGrant_TimeGenerated = TimeGenerated,
    PermissionGrant_OperationName = OperationName,
    PermissionGrant_Result = Result,
    PermissionGrant,
    AppDisplayName = tostring(modifiedProperties["ServicePrincipal.DisplayName"]["newValue"]),
    AppServicePrincipalId = tostring(modifiedProperties["ServicePrincipal.ObjectID"]["newValue"]),
    PermissionGrant_InitiatedBy = InitiatedBy,
    PermissionGrant_TargetResources = TargetResources,
    PermissionGrant_AdditionalDetails = AdditionalDetails,
    PermissionGrant_CorrelationId = CorrelationId
| join kind=inner (
    AuditLogs
    | where TimeGenerated > ago(query_frequency)
    | where Category =~ "RoleManagement"
        and LoggedByService =~ "Core Directory"
        and AADOperationType =~ "Assign"
    | where isnotempty(InitiatedBy["app"])
    | mv-expand TargetResource = TargetResources
    | mv-expand modifiedProperty = TargetResource["modifiedProperties"]
    | where tostring(modifiedProperty["displayName"]) in ("Role.DisplayName", "RoleDefinition.DisplayName")
    | extend RoleAssignment = tostring(modifiedProperty["newValue"])
    | where RoleAssignment contains "Admin"
    | project
        RoleAssignment_TimeGenerated = TimeGenerated,
        RoleAssignment_OperationName = OperationName,
        RoleAssignment_Result = Result,
        RoleAssignment,
        TargetType = tostring(TargetResources[0]["type"]),
        Target = iff(isnotempty(TargetResources[0]["displayName"]), tostring(TargetResources[0]["displayName"]), tolower(TargetResources[0]["userPrincipalName"])),
        TargetId = tostring(TargetResources[0]["id"]),
        RoleAssignment_InitiatedBy = InitiatedBy,
        RoleAssignment_TargetResources = TargetResources,
        RoleAssignment_AdditionalDetails = AdditionalDetails,
        RoleAssignment_CorrelationId = CorrelationId,
        AppServicePrincipalId = tostring(InitiatedBy["app"]["servicePrincipalId"])
    )
    on AppServicePrincipalId
| where PermissionGrant_TimeGenerated < RoleAssignment_TimeGenerated
| extend
    TargetName = tostring(split(Target, "@")[0]),
    TargetUPNSuffix = tostring(split(Target, "@")[1])
| project
        Alert_Category_en = "Entra ID",
    Alert_SubCategory_en = "Anomaly Identity Privilege Modification",
    Alert_Name_en = "Application Assigned Administrator Permissions Immediately After Obtaining Role Management Permissions",
    Alert_Description_en = strcat(
                           "At Taiwan time",
                           format_datetime(datetime_utc_to_local(RoleAssignment_TimeGenerated, "Asia/Taipei"), "yyyy-MM-dd HH:mm:ss"),
                           ". ",
                           "EntraID:",
                           "",
                           ". ",
                           "detected initiator: ",
                           tostring(PermissionGrant_InitiatedBy.user.userPrincipalName),
                           " granted application: ",
                           AppDisplayName,
                           " permission: ",
                           PermissionGrant,
                           "afterward, the application immediately assigned a role to target: ",
                           Target,
                           "role assignment: ",
                           RoleAssignment
                       ),
    Alert_TriageStep_en = strcat(
                          "1. Confirm initiator: ",
                          tostring(PermissionGrant_InitiatedBy.user.userPrincipalName),
                          "IP:",
                          tostring(PermissionGrant_InitiatedBy.ipAddress),
                          ", and review the authorized application: ",
                          AppDisplayName,
                          ", obtained permission: ",
                          PermissionGrant,
                          ", to determine whether it is expected behavior/automation. ",
                          "2. Review application: ",
                          AppDisplayName,
                          " for target: ",
                          Target,
                          " role assignment content: ",
                          RoleAssignment,
                          ", to determine whether it is expected behavior/automation. "
                      ),
    Alert_Containment_en = strcat(
                           "1. If determined to be unauthorized behavior, immediately disable initiator: ",
                           tostring(PermissionGrant_InitiatedBy.user.userPrincipalName),
                           " and application: ",
                           AppDisplayName,
                           ", and revoke its Directory/RoleManagement-related permissions. ",
                           "2. Immediately revert/remove the improper administrator role assignment: ",
                           Target,
                           ", and review whether other role/group/application assignments were changed."
                       ),
    Alert_Remediation_en =
    "1. Strengthen Conditional Access and account governance: enforce MFA/managed device and named location restrictions for administrator accounts, and block abnormal IPs. "
    "2. Implement least privilege and PIM: use Just-In-Time (JIT) activation with approval for administrator roles to reduce the risk of immediate abuse after account compromise. "
    "3. Strengthen detection and automation: establish automated response SOAR (notification/revoke authorization/disable application/revert role/block source).",
            Alert_Time_TW = datetime_utc_to_local(RoleAssignment_TimeGenerated, "Asia/Taipei"),
    Alert_Time_UTC0 = RoleAssignment_TimeGenerated,
    Event_Action = RoleAssignment_OperationName,
    Event_Status = RoleAssignment_Result,
    Event_Description = strcat("initiator: ", tostring(PermissionGrant_InitiatedBy.user.userPrincipalName), " to application: ", AppDisplayName, ", ", PermissionGrant_OperationName, ". Subsequently, application: ", AppDisplayName, " for target ", Target, ", ", RoleAssignment_OperationName),
    Source_Identity_FullName = AppDisplayName,
    Source_Identity_ID = AppServicePrincipalId,
    Source_Identity_Type = "Service",
    Target_Identity_FullName = Target,
    Target_Identity_ID = TargetId,
    Target_Identity_Name = TargetName,
    Target_Identity_Type = iff(TargetType has "User", "User", "Service"),
    Target_Resource_ID = "",
    Target_Resource_Name = "Microsoft Entra ID",
    Target_Resource_Type = "Microsoft Entra ID"
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: Source_Identity_FullName
    identifier: FullName
- entityType: CloudApplication
  fieldMappings:
  - columnName: Target_Identity_FullName
    identifier: Name
query: |
  let query_frequency = 1h;
  let query_period = 2h;
  AuditLogs
  | where TimeGenerated > ago(query_period)
  | where Category =~ "ApplicationManagement" and LoggedByService =~ "Core Directory"
  | where OperationName =~ "Add app role assignment to service principal"
  | mv-expand TargetResource = TargetResources
  | mv-expand modifiedProperty = TargetResource["modifiedProperties"]
  | where tostring(modifiedProperty["displayName"]) == "AppRole.Value"
  | extend PermissionGrant = tostring(modifiedProperty["newValue"])
  | where PermissionGrant has "RoleManagement.ReadWrite.Directory"
  | mv-apply modifiedProperty = TargetResource["modifiedProperties"] on (
      summarize modifiedProperties = make_bag(
                                     bag_pack(
      tostring(modifiedProperty["displayName"]),
      bag_pack(
      "oldValue",
      trim(@'[\"\s]+', tostring(modifiedProperty["oldValue"])),
      "newValue",
      trim(@'[\"\s]+', tostring(modifiedProperty["newValue"]))
  )
  ),
                                     100
                                 )
      )
  | project
      PermissionGrant_TimeGenerated = TimeGenerated,
      PermissionGrant_OperationName = OperationName,
      PermissionGrant_Result = Result,
      PermissionGrant,
      AppDisplayName = tostring(modifiedProperties["ServicePrincipal.DisplayName"]["newValue"]),
      AppServicePrincipalId = tostring(modifiedProperties["ServicePrincipal.ObjectID"]["newValue"]),
      PermissionGrant_InitiatedBy = InitiatedBy,
      PermissionGrant_TargetResources = TargetResources,
      PermissionGrant_AdditionalDetails = AdditionalDetails,
      PermissionGrant_CorrelationId = CorrelationId
  | join kind=inner (
      AuditLogs
      | where TimeGenerated > ago(query_frequency)
      | where Category =~ "RoleManagement"
          and LoggedByService =~ "Core Directory"
          and AADOperationType =~ "Assign"
      | where isnotempty(InitiatedBy["app"])
      | mv-expand TargetResource = TargetResources
      | mv-expand modifiedProperty = TargetResource["modifiedProperties"]
      | where tostring(modifiedProperty["displayName"]) in ("Role.DisplayName", "RoleDefinition.DisplayName")
      | extend RoleAssignment = tostring(modifiedProperty["newValue"])
      | where RoleAssignment contains "Admin"
      | project
          RoleAssignment_TimeGenerated = TimeGenerated,
          RoleAssignment_OperationName = OperationName,
          RoleAssignment_Result = Result,
          RoleAssignment,
          TargetType = tostring(TargetResources[0]["type"]),
          Target = iff(isnotempty(TargetResources[0]["displayName"]), tostring(TargetResources[0]["displayName"]), tolower(TargetResources[0]["userPrincipalName"])),
          TargetId = tostring(TargetResources[0]["id"]),
          RoleAssignment_InitiatedBy = InitiatedBy,
          RoleAssignment_TargetResources = TargetResources,
          RoleAssignment_AdditionalDetails = AdditionalDetails,
          RoleAssignment_CorrelationId = CorrelationId,
          AppServicePrincipalId = tostring(InitiatedBy["app"]["servicePrincipalId"])
      )
      on AppServicePrincipalId
  | where PermissionGrant_TimeGenerated < RoleAssignment_TimeGenerated
  | extend
      TargetName = tostring(split(Target, "@")[0]),
      TargetUPNSuffix = tostring(split(Target, "@")[1])
  | project
          Alert_Category_en = "Entra ID",
      Alert_SubCategory_en = "Anomaly Identity Privilege Modification",
      Alert_Name_en = "Application Assigned Administrator Permissions Immediately After Obtaining Role Management Permissions",
      Alert_Description_en = strcat(
                             "At Taiwan time",
                             format_datetime(datetime_utc_to_local(RoleAssignment_TimeGenerated, "Asia/Taipei"), "yyyy-MM-dd HH:mm:ss"),
                             ". ",
                             "EntraID:",
                             "",
                             ". ",
                             "detected initiator: ",
                             tostring(PermissionGrant_InitiatedBy.user.userPrincipalName),
                             " granted application: ",
                             AppDisplayName,
                             " permission: ",
                             PermissionGrant,
                             "afterward, the application immediately assigned a role to target: ",
                             Target,
                             "role assignment: ",
                             RoleAssignment
                         ),
      Alert_TriageStep_en = strcat(
                            "1. Confirm initiator: ",
                            tostring(PermissionGrant_InitiatedBy.user.userPrincipalName),
                            "IP:",
                            tostring(PermissionGrant_InitiatedBy.ipAddress),
                            ", and review the authorized application: ",
                            AppDisplayName,
                            ", obtained permission: ",
                            PermissionGrant,
                            ", to determine whether it is expected behavior/automation. ",
                            "2. Review application: ",
                            AppDisplayName,
                            " for target: ",
                            Target,
                            " role assignment content: ",
                            RoleAssignment,
                            ", to determine whether it is expected behavior/automation. "
                        ),
      Alert_Containment_en = strcat(
                             "1. If determined to be unauthorized behavior, immediately disable initiator: ",
                             tostring(PermissionGrant_InitiatedBy.user.userPrincipalName),
                             " and application: ",
                             AppDisplayName,
                             ", and revoke its Directory/RoleManagement-related permissions. ",
                             "2. Immediately revert/remove the improper administrator role assignment: ",
                             Target,
                             ", and review whether other role/group/application assignments were changed."
                         ),
      Alert_Remediation_en =
      "1. Strengthen Conditional Access and account governance: enforce MFA/managed device and named location restrictions for administrator accounts, and block abnormal IPs. "
      "2. Implement least privilege and PIM: use Just-In-Time (JIT) activation with approval for administrator roles to reduce the risk of immediate abuse after account compromise. "
      "3. Strengthen detection and automation: establish automated response SOAR (notification/revoke authorization/disable application/revert role/block source).",
              Alert_Time_TW = datetime_utc_to_local(RoleAssignment_TimeGenerated, "Asia/Taipei"),
      Alert_Time_UTC0 = RoleAssignment_TimeGenerated,
      Event_Action = RoleAssignment_OperationName,
      Event_Status = RoleAssignment_Result,
      Event_Description = strcat("initiator: ", tostring(PermissionGrant_InitiatedBy.user.userPrincipalName), " to application: ", AppDisplayName, ", ", PermissionGrant_OperationName, ". Subsequently, application: ", AppDisplayName, " for target ", Target, ", ", RoleAssignment_OperationName),
      Source_Identity_FullName = AppDisplayName,
      Source_Identity_ID = AppServicePrincipalId,
      Source_Identity_Type = "Service",
      Target_Identity_FullName = Target,
      Target_Identity_ID = TargetId,
      Target_Identity_Name = TargetName,
      Target_Identity_Type = iff(TargetType has "User", "User", "Service"),
      Target_Resource_ID = "",
      Target_Resource_Name = "Microsoft Entra ID",
      Target_Resource_Type = "Microsoft Entra ID"
id: 90bacdf4-e35b-47cb-92d1-29d8397eb4a0
queryFrequency: 1h
alertDetailsOverride:
  alertDynamicProperties: []
status: Available
severity: High
relevantTechniques:
- T1078.004
- T1098.003
version: 1.0.0
kind: Scheduled
tactics:
- Persistence
- PrivilegeEscalation
- DefenseEvasion
- InitialAccess
requiredDataConnectors:
- dataTypes:
  - AuditLogs
  connectorId: AzureActiveDirectory
description: |
  Detects an application receiving administrator permissions and then using them to assign a role. This pattern can indicate rapid privilege escalation through app consent abuse.
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/eDCRule/Analytic%20Rules/%5BEntra%20ID%5D%20Application%20Assigned%20Administrator%20Permissions%20Immediately%20After%20Obtaining%20Role%20Management%20Permissions.yaml
triggerOperator: gt
name: '[Entra ID] Application Assigned Administrator Permissions Immediately After Obtaining Role Management Permissions'
triggerThreshold: 0
queryPeriod: 2h
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/90bacdf4-e35b-47cb-92d1-29d8397eb4a0')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/90bacdf4-e35b-47cb-92d1-29d8397eb4a0')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDynamicProperties": []
        },
        "alertRuleTemplateName": "90bacdf4-e35b-47cb-92d1-29d8397eb4a0",
        "customDetails": null,
        "description": "Detects an application receiving administrator permissions and then using them to assign a role. This pattern can indicate rapid privilege escalation through app consent abuse.\n",
        "displayName": "[Entra ID] Application Assigned Administrator Permissions Immediately After Obtaining Role Management Permissions",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "Source_Identity_FullName",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "Target_Identity_FullName",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/eDCRule/Analytic%20Rules/%5BEntra%20ID%5D%20Application%20Assigned%20Administrator%20Permissions%20Immediately%20After%20Obtaining%20Role%20Management%20Permissions.yaml",
        "query": "let query_frequency = 1h;\nlet query_period = 2h;\nAuditLogs\n| where TimeGenerated > ago(query_period)\n| where Category =~ \"ApplicationManagement\" and LoggedByService =~ \"Core Directory\"\n| where OperationName =~ \"Add app role assignment to service principal\"\n| mv-expand TargetResource = TargetResources\n| mv-expand modifiedProperty = TargetResource[\"modifiedProperties\"]\n| where tostring(modifiedProperty[\"displayName\"]) == \"AppRole.Value\"\n| extend PermissionGrant = tostring(modifiedProperty[\"newValue\"])\n| where PermissionGrant has \"RoleManagement.ReadWrite.Directory\"\n| mv-apply modifiedProperty = TargetResource[\"modifiedProperties\"] on (\n    summarize modifiedProperties = make_bag(\n                                   bag_pack(\n    tostring(modifiedProperty[\"displayName\"]),\n    bag_pack(\n    \"oldValue\",\n    trim(@'[\\\"\\s]+', tostring(modifiedProperty[\"oldValue\"])),\n    \"newValue\",\n    trim(@'[\\\"\\s]+', tostring(modifiedProperty[\"newValue\"]))\n)\n),\n                                   100\n                               )\n    )\n| project\n    PermissionGrant_TimeGenerated = TimeGenerated,\n    PermissionGrant_OperationName = OperationName,\n    PermissionGrant_Result = Result,\n    PermissionGrant,\n    AppDisplayName = tostring(modifiedProperties[\"ServicePrincipal.DisplayName\"][\"newValue\"]),\n    AppServicePrincipalId = tostring(modifiedProperties[\"ServicePrincipal.ObjectID\"][\"newValue\"]),\n    PermissionGrant_InitiatedBy = InitiatedBy,\n    PermissionGrant_TargetResources = TargetResources,\n    PermissionGrant_AdditionalDetails = AdditionalDetails,\n    PermissionGrant_CorrelationId = CorrelationId\n| join kind=inner (\n    AuditLogs\n    | where TimeGenerated > ago(query_frequency)\n    | where Category =~ \"RoleManagement\"\n        and LoggedByService =~ \"Core Directory\"\n        and AADOperationType =~ \"Assign\"\n    | where isnotempty(InitiatedBy[\"app\"])\n    | mv-expand TargetResource = TargetResources\n    | mv-expand modifiedProperty = TargetResource[\"modifiedProperties\"]\n    | where tostring(modifiedProperty[\"displayName\"]) in (\"Role.DisplayName\", \"RoleDefinition.DisplayName\")\n    | extend RoleAssignment = tostring(modifiedProperty[\"newValue\"])\n    | where RoleAssignment contains \"Admin\"\n    | project\n        RoleAssignment_TimeGenerated = TimeGenerated,\n        RoleAssignment_OperationName = OperationName,\n        RoleAssignment_Result = Result,\n        RoleAssignment,\n        TargetType = tostring(TargetResources[0][\"type\"]),\n        Target = iff(isnotempty(TargetResources[0][\"displayName\"]), tostring(TargetResources[0][\"displayName\"]), tolower(TargetResources[0][\"userPrincipalName\"])),\n        TargetId = tostring(TargetResources[0][\"id\"]),\n        RoleAssignment_InitiatedBy = InitiatedBy,\n        RoleAssignment_TargetResources = TargetResources,\n        RoleAssignment_AdditionalDetails = AdditionalDetails,\n        RoleAssignment_CorrelationId = CorrelationId,\n        AppServicePrincipalId = tostring(InitiatedBy[\"app\"][\"servicePrincipalId\"])\n    )\n    on AppServicePrincipalId\n| where PermissionGrant_TimeGenerated < RoleAssignment_TimeGenerated\n| extend\n    TargetName = tostring(split(Target, \"@\")[0]),\n    TargetUPNSuffix = tostring(split(Target, \"@\")[1])\n| project\n        Alert_Category_en = \"Entra ID\",\n    Alert_SubCategory_en = \"Anomaly Identity Privilege Modification\",\n    Alert_Name_en = \"Application Assigned Administrator Permissions Immediately After Obtaining Role Management Permissions\",\n    Alert_Description_en = strcat(\n                           \"At Taiwan time\",\n                           format_datetime(datetime_utc_to_local(RoleAssignment_TimeGenerated, \"Asia/Taipei\"), \"yyyy-MM-dd HH:mm:ss\"),\n                           \". \",\n                           \"EntraID:\",\n                           \"\",\n                           \". \",\n                           \"detected initiator: \",\n                           tostring(PermissionGrant_InitiatedBy.user.userPrincipalName),\n                           \" granted application: \",\n                           AppDisplayName,\n                           \" permission: \",\n                           PermissionGrant,\n                           \"afterward, the application immediately assigned a role to target: \",\n                           Target,\n                           \"role assignment: \",\n                           RoleAssignment\n                       ),\n    Alert_TriageStep_en = strcat(\n                          \"1. Confirm initiator: \",\n                          tostring(PermissionGrant_InitiatedBy.user.userPrincipalName),\n                          \"IP:\",\n                          tostring(PermissionGrant_InitiatedBy.ipAddress),\n                          \", and review the authorized application: \",\n                          AppDisplayName,\n                          \", obtained permission: \",\n                          PermissionGrant,\n                          \", to determine whether it is expected behavior/automation. \",\n                          \"2. Review application: \",\n                          AppDisplayName,\n                          \" for target: \",\n                          Target,\n                          \" role assignment content: \",\n                          RoleAssignment,\n                          \", to determine whether it is expected behavior/automation. \"\n                      ),\n    Alert_Containment_en = strcat(\n                           \"1. If determined to be unauthorized behavior, immediately disable initiator: \",\n                           tostring(PermissionGrant_InitiatedBy.user.userPrincipalName),\n                           \" and application: \",\n                           AppDisplayName,\n                           \", and revoke its Directory/RoleManagement-related permissions. \",\n                           \"2. Immediately revert/remove the improper administrator role assignment: \",\n                           Target,\n                           \", and review whether other role/group/application assignments were changed.\"\n                       ),\n    Alert_Remediation_en =\n    \"1. Strengthen Conditional Access and account governance: enforce MFA/managed device and named location restrictions for administrator accounts, and block abnormal IPs. \"\n    \"2. Implement least privilege and PIM: use Just-In-Time (JIT) activation with approval for administrator roles to reduce the risk of immediate abuse after account compromise. \"\n    \"3. Strengthen detection and automation: establish automated response SOAR (notification/revoke authorization/disable application/revert role/block source).\",\n            Alert_Time_TW = datetime_utc_to_local(RoleAssignment_TimeGenerated, \"Asia/Taipei\"),\n    Alert_Time_UTC0 = RoleAssignment_TimeGenerated,\n    Event_Action = RoleAssignment_OperationName,\n    Event_Status = RoleAssignment_Result,\n    Event_Description = strcat(\"initiator: \", tostring(PermissionGrant_InitiatedBy.user.userPrincipalName), \" to application: \", AppDisplayName, \", \", PermissionGrant_OperationName, \". Subsequently, application: \", AppDisplayName, \" for target \", Target, \", \", RoleAssignment_OperationName),\n    Source_Identity_FullName = AppDisplayName,\n    Source_Identity_ID = AppServicePrincipalId,\n    Source_Identity_Type = \"Service\",\n    Target_Identity_FullName = Target,\n    Target_Identity_ID = TargetId,\n    Target_Identity_Name = TargetName,\n    Target_Identity_Type = iff(TargetType has \"User\", \"User\", \"Service\"),\n    Target_Resource_ID = \"\",\n    Target_Resource_Name = \"Microsoft Entra ID\",\n    Target_Resource_Type = \"Microsoft Entra ID\"\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT2H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [
          "T1078.004",
          "T1098.003"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "InitialAccess",
          "Persistence",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1078",
          "T1098"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}