This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

This has been closed due to inactivity. If you feel this is an error, please re-open and include a justifying comment.

👋🏽 Hey @austinsonger. Thanks for opening this request. After further review and reading a recent Permiso blog, I agree this is a decent signal of privilege escalation into Azure resources if a global admin in Entra ID is compromised. As a result, I've opened a new PR and linked it to this issue.

As you are aware, global admins in Entra ID do not always transfer RBAC to Azure subscriptions that may exist as they are intentionally separated. However, a global admin can elevate their privileges to control subscriptions via a simple toggle in Entra ID. While I did not find a great example of this in-the-wild via OSINT - Permiso has a decent blog covering this from red-team perspective - https://permiso.io/blog/azures-apex-permissions-elevate-access-the-logs-security-teams-overlook

As a side note, when I replicated this and reviewed telemetry, I noticed this was only logged for us in Entra ID audit logs where the query was

event.dataset: azure.auditlogs and azure.auditlogs.operation_name: "User has elevated their access to User Access Administrator for their Azure Resources"

We will keep the query to Entra ID audit logs only for now to allow the opportunity for tuning if necessary on a single data source.