Guest user account type changed to member

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

Identifies Entra ID user accounts converted from Guest to Member type, which grants full member-level access and may indicate an attacker elevating a compromised guest account to persistent tenant access.

Attribute	Value
Type	Hunting Query
Solution	Standalone Content
ID	d7684f21-18c0-4597-b79f-1ae5f2c7ab86
Tactics	Persistence
Techniques	T1098
Required Connectors	AzureActiveDirectory
Source	[View on GitHub](https://github.com/Azure/Azure-Sentinel/blob/master/Hunting Queries/AuditLogs/GuestUserTypeChangedToMember.yaml)

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Hunting Queries