Power Platform - Account added to privileged Microsoft Entra roles

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


Identifies changes to privileged directory roles impacting Power Platform: - Dynamics 365 Admins - Power Platform Admins - Fabric Admins

Attribute Value
Type Analytic Rule
Solution Microsoft Business Applications
ID 71d829d6-eb50-4a17-8a64-655fae8d71e1
Severity Low
Status Available
Kind Scheduled
Tactics PrivilegeEscalation
Techniques T1078, T1068, T1548
Required Connectors AzureActiveDirectory
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
AuditLogs Identity != "MS-PIM"
Identity != "MS-PIM-Fairfax"

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Analytic Rules · Back to Microsoft Business Applications