This detection rule monitors for modifications to privileged Azure Active Directory (Azure AD/Entra ID) roles, including role assignments, removals, and permission changes. Privileged role modifications represent a critical security event as they can grant attackers persistent administrative access to cloud resources, enable privilege escalation, and facilitate lateral movement across Azure environments.
