Analytic rule catalog
[Entra ID] Privilege Elevation Request Denied
Back
| Id | aceee46e-8fb3-42d9-967a-aac637bcefd4 |
| Rulename | [Entra ID] Privilege Elevation Request Denied |
| Description | Detects denied privilege elevation requests in Microsoft Entra ID. Review the requester and the target workflow for possible abuse or misconfiguration. |
| Severity | High |
| Tactics | Persistence PrivilegeEscalation DefenseEvasion InitialAccess |
| Techniques | T1078.004 |
| Required data connectors | AzureActiveDirectory |
| Kind | Scheduled |
| Query frequency | 2h |
| Query period | 2h |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/eDCRule/Analytic%20Rules/%5BEntra%20ID%5D%20Privilege%20Elevation%20Request%20Denied.yaml |
| Version | 1.0.0 |
| Arm template | aceee46e-8fb3-42d9-967a-aac637bcefd4.json |
AuditLogs
| where ActivityDisplayName =~ 'Add member to role request denied (PIM activation)'
| mv-apply ResourceItem = TargetResources on
(
where ResourceItem.type =~ "Role"
| extend Role = trim(@'"', tostring(ResourceItem.displayName))
)
| mv-apply ResourceItem = TargetResources on
(
where ResourceItem.type =~ "User"
| extend TargetUserPrincipalName = trim(@'"', tostring(ResourceItem.userPrincipalName))
)
//| where ResultReason != "RoleAssignmentExists"
| where isnotempty(InitiatedBy.user)
| extend InitiatingAppName = tostring(InitiatedBy.app.displayName)
| extend InitiatingAppServicePrincipalId = tostring(InitiatedBy.app.servicePrincipalId)
| extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)
| extend InitiatingAadUserId = tostring(InitiatedBy.user.id)
| extend InitiatingIpAddress = tostring(iff(isnotempty(InitiatedBy.user.ipAddress), InitiatedBy.user.ipAddress, InitiatedBy.app.ipAddress))
| extend
TargetName = tostring(split(TargetUserPrincipalName, '@', 0)[0]),
TargetUPNSuffix = tostring(split(TargetUserPrincipalName, '@', 1)[0])
| extend
InitiatedByName = tostring(split(InitiatingUserPrincipalName, '@', 0)[0]),
InitiatedByUPNSuffix = tostring(split(InitiatingUserPrincipalName, '@', 1)[0])
| project-reorder
TimeGenerated,
TargetUserPrincipalName,
Role,
OperationName,
Result,
ResultDescription
| extend
InitiatingUser = tostring(InitiatedBy.user.userPrincipalName)
| extend Source_Network_IPLocation = ""
| project
Alert_Category_en = "Entra ID",
Alert_SubCategory_en = "Anomaly Identity Privilege Modification",
Alert_Name_en = "Privilege Elevation Request Denied",
Alert_Description_en=strcat(
"At Taiwan time: ",
format_datetime(datetime_utc_to_local(TimeGenerated, "Asia/Taipei"), "yyyy-MM-dd HH:mm:ss"),
" in Entra ID: ",
"",
", detected PIM role activation failure: target user: ",
iff(isnotempty(TargetUserPrincipalName), TargetUserPrincipalName, "<NoTargetUser>"),
", target role: ",
iff(isnotempty(Role), Role, "<NoRole>"),
", initiator: ",
iff(isnotempty(InitiatingUser), InitiatingUser, "<NoInitiator>"),
", source IP: ",
iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, "<NoIP>"),
", result: ",
iff(isnotempty(Result), Result, "<NoResult>"),
" (reason: ",
iff(isnotempty(ResultDescription), ResultDescription, "<NoReason>"),
")."
),
Alert_TriageStep_en=strcat(
"1. Confirm the activation target: user: ",
iff(isnotempty(TargetUserPrincipalName), TargetUserPrincipalName, "<NoTargetUser>"),
", role: ",
iff(isnotempty(Role), Role, "<NoRole>"),
" is an expected PIM activation request.",
"2. Check the failure reason: ",
iff(isnotempty(ResultDescription), ResultDescription, "<NoReason>"),
", and determine whether it was caused by MFA/Conditional Access/approval process/insufficient permissions.",
"3. Check source risk: ",
iff(isnotempty(InitiatingUser), InitiatingUser, "<NoInitiator>"),
", IP:",
iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, "<NoIP>"),
" to determine whether it is a company named location/VPN/jump server, abnormal location, or uncommon source."
),
Alert_Containment_en=strcat(
"1. If determined to be a suspicious attempt, immediately restrict initiator: ",
iff(isnotempty(InitiatingUser), InitiatingUser, "<NoInitiator>"),
" 's PIM activation permissions or suspend the scope of high-risk roles that can be activated. ",
"2. Immediately revoke suspicious sign-in tokens/sessions and force re-authentication (initiator: ",
iff(isnotempty(InitiatingUser), InitiatingUser, "<NoInitiator>"),
"), and reset the password and re-register MFA if necessary. ",
"3. Apply stricter Conditional Access to source IP: ",
iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, "<NoIP>"),
" (named locations/compliant devices/MFA only), or block it first to stop repeated attempts. ",
"4. If the failure was caused by the approval process/policy, suspend activation requests outside the change window and notify administrators for confirmation."
),
Alert_Remediation_en=strcat(
"1. Strengthen PIM governance: require approval and justification for high-privilege role activation, and limit the scope of activatable roles (least privilege/separation of duties). ",
"2. Strengthen Conditional Access: enforce MFA, compliant devices, and named locations for PIM/management-plane operations, and directly block abnormal IPs/locations. ",
"3. Establish alerts and automated response: set thresholds and automated SOAR for PIM activation failures (notification, IP blocking, account suspension). "
),
Alert_Time_TW = datetime_utc_to_local(TimeGenerated, 'Asia/Taipei'),
Alert_Time_UTC0 = TimeGenerated,
Event_Action = OperationName,
Event_Status = Result,
Event_Description = ResultDescription,
Source_Identity_FullName = InitiatingUser,
Source_Identity_ID = InitiatingAadUserId,
// Source_Identity_Name = InitiatingName,
Source_Identity_Type = iff(isnotempty(InitiatingUser), "User", "Service"),
Source_Network_IPAddress = InitiatingIpAddress,
Target_Identity_FullName = TargetUserPrincipalName,
Source_Resource_ID = InitiatingAppServicePrincipalId,
Source_Resource_Name = InitiatingAppName,
//Target_Identity_Name = InvitedUserName,
Target_Identity_Type = "User",
Target_Identity_DomainType = iff(TargetUserPrincipalName contains "EXT", 'External', 'Internal'),
Target_Resource_ID = "",
Target_Resource_Name = "Microsoft Entra ID",
Target_Resource_Type = "Microsoft Entra ID"
entityMappings:
- entityType: Account
fieldMappings:
- columnName: Source_Identity_FullName
identifier: FullName
- entityType: Account
fieldMappings:
- columnName: Target_Identity_FullName
identifier: FullName
- entityType: IP
fieldMappings:
- columnName: Source_Network_IPAddress
identifier: Address
query: |
AuditLogs
| where ActivityDisplayName =~ 'Add member to role request denied (PIM activation)'
| mv-apply ResourceItem = TargetResources on
(
where ResourceItem.type =~ "Role"
| extend Role = trim(@'"', tostring(ResourceItem.displayName))
)
| mv-apply ResourceItem = TargetResources on
(
where ResourceItem.type =~ "User"
| extend TargetUserPrincipalName = trim(@'"', tostring(ResourceItem.userPrincipalName))
)
//| where ResultReason != "RoleAssignmentExists"
| where isnotempty(InitiatedBy.user)
| extend InitiatingAppName = tostring(InitiatedBy.app.displayName)
| extend InitiatingAppServicePrincipalId = tostring(InitiatedBy.app.servicePrincipalId)
| extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)
| extend InitiatingAadUserId = tostring(InitiatedBy.user.id)
| extend InitiatingIpAddress = tostring(iff(isnotempty(InitiatedBy.user.ipAddress), InitiatedBy.user.ipAddress, InitiatedBy.app.ipAddress))
| extend
TargetName = tostring(split(TargetUserPrincipalName, '@', 0)[0]),
TargetUPNSuffix = tostring(split(TargetUserPrincipalName, '@', 1)[0])
| extend
InitiatedByName = tostring(split(InitiatingUserPrincipalName, '@', 0)[0]),
InitiatedByUPNSuffix = tostring(split(InitiatingUserPrincipalName, '@', 1)[0])
| project-reorder
TimeGenerated,
TargetUserPrincipalName,
Role,
OperationName,
Result,
ResultDescription
| extend
InitiatingUser = tostring(InitiatedBy.user.userPrincipalName)
| extend Source_Network_IPLocation = ""
| project
Alert_Category_en = "Entra ID",
Alert_SubCategory_en = "Anomaly Identity Privilege Modification",
Alert_Name_en = "Privilege Elevation Request Denied",
Alert_Description_en=strcat(
"At Taiwan time: ",
format_datetime(datetime_utc_to_local(TimeGenerated, "Asia/Taipei"), "yyyy-MM-dd HH:mm:ss"),
" in Entra ID: ",
"",
", detected PIM role activation failure: target user: ",
iff(isnotempty(TargetUserPrincipalName), TargetUserPrincipalName, "<NoTargetUser>"),
", target role: ",
iff(isnotempty(Role), Role, "<NoRole>"),
", initiator: ",
iff(isnotempty(InitiatingUser), InitiatingUser, "<NoInitiator>"),
", source IP: ",
iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, "<NoIP>"),
", result: ",
iff(isnotempty(Result), Result, "<NoResult>"),
" (reason: ",
iff(isnotempty(ResultDescription), ResultDescription, "<NoReason>"),
")."
),
Alert_TriageStep_en=strcat(
"1. Confirm the activation target: user: ",
iff(isnotempty(TargetUserPrincipalName), TargetUserPrincipalName, "<NoTargetUser>"),
", role: ",
iff(isnotempty(Role), Role, "<NoRole>"),
" is an expected PIM activation request.",
"2. Check the failure reason: ",
iff(isnotempty(ResultDescription), ResultDescription, "<NoReason>"),
", and determine whether it was caused by MFA/Conditional Access/approval process/insufficient permissions.",
"3. Check source risk: ",
iff(isnotempty(InitiatingUser), InitiatingUser, "<NoInitiator>"),
", IP:",
iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, "<NoIP>"),
" to determine whether it is a company named location/VPN/jump server, abnormal location, or uncommon source."
),
Alert_Containment_en=strcat(
"1. If determined to be a suspicious attempt, immediately restrict initiator: ",
iff(isnotempty(InitiatingUser), InitiatingUser, "<NoInitiator>"),
" 's PIM activation permissions or suspend the scope of high-risk roles that can be activated. ",
"2. Immediately revoke suspicious sign-in tokens/sessions and force re-authentication (initiator: ",
iff(isnotempty(InitiatingUser), InitiatingUser, "<NoInitiator>"),
"), and reset the password and re-register MFA if necessary. ",
"3. Apply stricter Conditional Access to source IP: ",
iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, "<NoIP>"),
" (named locations/compliant devices/MFA only), or block it first to stop repeated attempts. ",
"4. If the failure was caused by the approval process/policy, suspend activation requests outside the change window and notify administrators for confirmation."
),
Alert_Remediation_en=strcat(
"1. Strengthen PIM governance: require approval and justification for high-privilege role activation, and limit the scope of activatable roles (least privilege/separation of duties). ",
"2. Strengthen Conditional Access: enforce MFA, compliant devices, and named locations for PIM/management-plane operations, and directly block abnormal IPs/locations. ",
"3. Establish alerts and automated response: set thresholds and automated SOAR for PIM activation failures (notification, IP blocking, account suspension). "
),
Alert_Time_TW = datetime_utc_to_local(TimeGenerated, 'Asia/Taipei'),
Alert_Time_UTC0 = TimeGenerated,
Event_Action = OperationName,
Event_Status = Result,
Event_Description = ResultDescription,
Source_Identity_FullName = InitiatingUser,
Source_Identity_ID = InitiatingAadUserId,
// Source_Identity_Name = InitiatingName,
Source_Identity_Type = iff(isnotempty(InitiatingUser), "User", "Service"),
Source_Network_IPAddress = InitiatingIpAddress,
Target_Identity_FullName = TargetUserPrincipalName,
Source_Resource_ID = InitiatingAppServicePrincipalId,
Source_Resource_Name = InitiatingAppName,
//Target_Identity_Name = InvitedUserName,
Target_Identity_Type = "User",
Target_Identity_DomainType = iff(TargetUserPrincipalName contains "EXT", 'External', 'Internal'),
Target_Resource_ID = "",
Target_Resource_Name = "Microsoft Entra ID",
Target_Resource_Type = "Microsoft Entra ID"
id: aceee46e-8fb3-42d9-967a-aac637bcefd4
queryFrequency: 2h
status: Available
severity: High
relevantTechniques:
- T1078.004
version: 1.0.0
kind: Scheduled
tactics:
- Persistence
- PrivilegeEscalation
- DefenseEvasion
- InitialAccess
requiredDataConnectors:
- dataTypes:
- AuditLogs
connectorId: AzureActiveDirectory
description: |
Detects denied privilege elevation requests in Microsoft Entra ID. Review the requester and the target workflow for possible abuse or misconfiguration.
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/eDCRule/Analytic%20Rules/%5BEntra%20ID%5D%20Privilege%20Elevation%20Request%20Denied.yaml
triggerOperator: gt
name: '[Entra ID] Privilege Elevation Request Denied'
triggerThreshold: 0
queryPeriod: 2h
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/aceee46e-8fb3-42d9-967a-aac637bcefd4')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/aceee46e-8fb3-42d9-967a-aac637bcefd4')]",
"properties": {
"alertRuleTemplateName": "aceee46e-8fb3-42d9-967a-aac637bcefd4",
"customDetails": null,
"description": "Detects denied privilege elevation requests in Microsoft Entra ID. Review the requester and the target workflow for possible abuse or misconfiguration.\n",
"displayName": "[Entra ID] Privilege Elevation Request Denied",
"enabled": true,
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "Source_Identity_FullName",
"identifier": "FullName"
}
]
},
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "Target_Identity_FullName",
"identifier": "FullName"
}
]
},
{
"entityType": "IP",
"fieldMappings": [
{
"columnName": "Source_Network_IPAddress",
"identifier": "Address"
}
]
}
],
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/eDCRule/Analytic%20Rules/%5BEntra%20ID%5D%20Privilege%20Elevation%20Request%20Denied.yaml",
"query": "AuditLogs\n| where ActivityDisplayName =~ 'Add member to role request denied (PIM activation)'\n| mv-apply ResourceItem = TargetResources on\n (\n where ResourceItem.type =~ \"Role\"\n | extend Role = trim(@'\"', tostring(ResourceItem.displayName))\n )\n| mv-apply ResourceItem = TargetResources on\n (\n where ResourceItem.type =~ \"User\"\n | extend TargetUserPrincipalName = trim(@'\"', tostring(ResourceItem.userPrincipalName))\n )\n//| where ResultReason != \"RoleAssignmentExists\"\n| where isnotempty(InitiatedBy.user)\n| extend InitiatingAppName = tostring(InitiatedBy.app.displayName)\n| extend InitiatingAppServicePrincipalId = tostring(InitiatedBy.app.servicePrincipalId)\n| extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)\n| extend InitiatingAadUserId = tostring(InitiatedBy.user.id)\n| extend InitiatingIpAddress = tostring(iff(isnotempty(InitiatedBy.user.ipAddress), InitiatedBy.user.ipAddress, InitiatedBy.app.ipAddress))\n| extend\n TargetName = tostring(split(TargetUserPrincipalName, '@', 0)[0]),\n TargetUPNSuffix = tostring(split(TargetUserPrincipalName, '@', 1)[0])\n| extend\n InitiatedByName = tostring(split(InitiatingUserPrincipalName, '@', 0)[0]),\n InitiatedByUPNSuffix = tostring(split(InitiatingUserPrincipalName, '@', 1)[0])\n| project-reorder\n TimeGenerated,\n TargetUserPrincipalName,\n Role,\n OperationName,\n Result,\n ResultDescription\n| extend\n InitiatingUser = tostring(InitiatedBy.user.userPrincipalName)\n| extend Source_Network_IPLocation = \"\"\n| project\n Alert_Category_en = \"Entra ID\",\n Alert_SubCategory_en = \"Anomaly Identity Privilege Modification\",\n Alert_Name_en = \"Privilege Elevation Request Denied\",\n Alert_Description_en=strcat(\n \"At Taiwan time: \",\n format_datetime(datetime_utc_to_local(TimeGenerated, \"Asia/Taipei\"), \"yyyy-MM-dd HH:mm:ss\"),\n \" in Entra ID: \",\n \"\",\n \", detected PIM role activation failure: target user: \",\n iff(isnotempty(TargetUserPrincipalName), TargetUserPrincipalName, \"<NoTargetUser>\"),\n \", target role: \",\n iff(isnotempty(Role), Role, \"<NoRole>\"),\n \", initiator: \",\n iff(isnotempty(InitiatingUser), InitiatingUser, \"<NoInitiator>\"),\n \", source IP: \",\n iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, \"<NoIP>\"),\n \", result: \",\n iff(isnotempty(Result), Result, \"<NoResult>\"),\n \" (reason: \",\n iff(isnotempty(ResultDescription), ResultDescription, \"<NoReason>\"),\n \").\"\n ),\n Alert_TriageStep_en=strcat(\n \"1. Confirm the activation target: user: \",\n iff(isnotempty(TargetUserPrincipalName), TargetUserPrincipalName, \"<NoTargetUser>\"),\n \", role: \",\n iff(isnotempty(Role), Role, \"<NoRole>\"),\n \" is an expected PIM activation request.\",\n \"2. Check the failure reason: \",\n iff(isnotempty(ResultDescription), ResultDescription, \"<NoReason>\"),\n \", and determine whether it was caused by MFA/Conditional Access/approval process/insufficient permissions.\",\n \"3. Check source risk: \",\n iff(isnotempty(InitiatingUser), InitiatingUser, \"<NoInitiator>\"),\n \", IP:\",\n iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, \"<NoIP>\"),\n \" to determine whether it is a company named location/VPN/jump server, abnormal location, or uncommon source.\"\n ),\n Alert_Containment_en=strcat(\n \"1. If determined to be a suspicious attempt, immediately restrict initiator: \",\n iff(isnotempty(InitiatingUser), InitiatingUser, \"<NoInitiator>\"),\n \" 's PIM activation permissions or suspend the scope of high-risk roles that can be activated. \",\n \"2. Immediately revoke suspicious sign-in tokens/sessions and force re-authentication (initiator: \",\n iff(isnotempty(InitiatingUser), InitiatingUser, \"<NoInitiator>\"),\n \"), and reset the password and re-register MFA if necessary. \",\n \"3. Apply stricter Conditional Access to source IP: \",\n iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, \"<NoIP>\"),\n \" (named locations/compliant devices/MFA only), or block it first to stop repeated attempts. \",\n \"4. If the failure was caused by the approval process/policy, suspend activation requests outside the change window and notify administrators for confirmation.\"\n ),\n Alert_Remediation_en=strcat(\n \"1. Strengthen PIM governance: require approval and justification for high-privilege role activation, and limit the scope of activatable roles (least privilege/separation of duties). \",\n \"2. Strengthen Conditional Access: enforce MFA, compliant devices, and named locations for PIM/management-plane operations, and directly block abnormal IPs/locations. \",\n \"3. Establish alerts and automated response: set thresholds and automated SOAR for PIM activation failures (notification, IP blocking, account suspension). \"\n ),\n Alert_Time_TW = datetime_utc_to_local(TimeGenerated, 'Asia/Taipei'),\n Alert_Time_UTC0 = TimeGenerated,\n Event_Action = OperationName,\n Event_Status = Result,\n Event_Description = ResultDescription,\n Source_Identity_FullName = InitiatingUser,\n Source_Identity_ID = InitiatingAadUserId,\n // Source_Identity_Name = InitiatingName,\n Source_Identity_Type = iff(isnotempty(InitiatingUser), \"User\", \"Service\"),\n Source_Network_IPAddress = InitiatingIpAddress,\n Target_Identity_FullName = TargetUserPrincipalName,\n Source_Resource_ID = InitiatingAppServicePrincipalId,\n Source_Resource_Name = InitiatingAppName,\n //Target_Identity_Name = InvitedUserName,\n Target_Identity_Type = \"User\",\n Target_Identity_DomainType = iff(TargetUserPrincipalName contains \"EXT\", 'External', 'Internal'),\n Target_Resource_ID = \"\",\n Target_Resource_Name = \"Microsoft Entra ID\",\n Target_Resource_Type = \"Microsoft Entra ID\"\n",
"queryFrequency": "PT2H",
"queryPeriod": "PT2H",
"severity": "High",
"status": "Available",
"subTechniques": [
"T1078.004"
],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"DefenseEvasion",
"InitialAccess",
"Persistence",
"PrivilegeEscalation"
],
"techniques": [
"T1078"
],
"templateVersion": "1.0.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}