# Entra ID Elevated Access to User Access Administrator

[edit](https://github.com/elastic/security-docs/edit/8.19/docs/detections/prebuilt-rules/downloadable-packages/8-19-20/prebuilt-rule-8-19-20-entra-id-elevated-access-to-user-access-administrator.asciidoc "Edit this page on GitHub")

**IMPORTANT**: This documentation is no longer updated. Refer to [Elastic's version policy](/content/support/eol/index.html) and the [latest documentation](/content/docs/index.html).

## Entra ID Elevated Access to User Access Administrator

Identifies when a user has elevated their access to User Access Administrator for their Azure Resources. The User Access Administrator role allows users to manage user access to Azure resources, including the ability to assign roles and permissions. Adversaries may target an Entra ID Global Administrator or other privileged role to elevate their access to User Access Administrator, which can lead to further privilege escalation and unauthorized access to sensitive resources. This is a New Terms rule that only signals if the user principal name has not been seen doing this activity in the last 14 days.

**Rule type**: new\_terms

**Rule indices**:

- filebeat-\*

- logs-azure.auditlogs-\*

**Severity**: high

**Risk score**: 73

**Runs every**: 5m

**Searches indices from**: now-9m ( [Date Math format](/content/guide/en/elasticsearch/reference/8.19/common-options.html#date-math/index.html), see also [`Additional look-back time`](/content/guide/en/security/current/rules-ui-create.html#rule-schedule "Set the rule’s schedule"/index.html))

**Maximum alerts per execution**: 100

**References**:

- [https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin?tabs=azure-portal%2Centra-audit-logs/](https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin?tabs=azure-portal%2Centra-audit-logs/)
- [https://permiso.io/blog/azures-apex-permissions-elevate-access-the-logs-security-teams-overlook](https://permiso.io/blog/azures-apex-permissions-elevate-access-the-logs-security-teams-overlook)
- [https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/](https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/)

**Tags**:

- Domain: Cloud

- Domain: Identity

- Data Source: Azure

- Data Source: Microsoft Entra ID

- Data Source: Microsoft Entra ID Audit Logs

- Use Case: Identity and Access Audit

- Tactic: Privilege Escalation

- Resources: Investigation Guide

**Version**: 4

**Rule authors**:

- Elastic

- Austin Songer

**Rule license**: Elastic License v2

## Investigation guide

**Triage and Analysis**

**Investigating Entra ID Elevated Access to User Access Administrator**

This rule identifies when a user elevates their permissions to the "User Access Administrator" role in Azure RBAC. This role allows full control over access management for Azure resources and can be abused by attackers for lateral movement, persistence, or privilege escalation. Since this is a New Terms rule, the alert will only trigger if the user has not performed this elevation in the past 14 days, helping reduce alert fatigue.

**Possible investigation steps**

- Review the `azure.auditlogs.properties.initiated_by.user.userPrincipalName` field to identify the user who elevated access.

- Check `source.ip` and associated `source.geo.*` fields to determine the origin of the action. Confirm whether the IP, ASN, and location are expected for this user.

- Investigate the application ID from `azure.auditlogs.properties.additional_details.value` to determine which interface or method was used to elevate access.

- Pivot to Azure `signinlogs` or Entra `auditlogs` to:

- Review recent login history for the user.

- Look for unusual sign-in patterns or MFA prompts.

- Determine whether the account has performed any other privilege-related operations.

- Correlate with directory role assignments or role-based access control (RBAC) modifications to assess whether the elevated access was used to add roles or modify permissions.

**False positive analysis**

- Legitimate admin actions may involve access elevation during maintenance, migration, or investigations.

- Some IT departments may elevate access temporarily without leaving structured change records.

- Review internal tickets, change logs, or admin activity dashboards for approved operations.

**Response and remediation**

- If elevation was not authorized:

- Immediately remove the User Access Administrator role from the account.

- Disable or lock the account and begin credential rotation.

- Audit activity performed by the account after elevation, especially changes to role assignments and resource access.

- If suspicious:

- Notify the user and confirm whether they performed the action.

- Check for any automation or scripts that could be exploiting unused elevated access paths.

- Review conditional access and PIM (Privileged Identity Management) configurations to limit elevation without approval.

- Strengthen posture:

- Require MFA and approval for all privilege escalation actions.

- Consider enabling JIT (Just-in-Time) access with expiration.

- Add alerts for repeated or unusual use of `Microsoft.Authorization/elevateAccess/action`.

## Rule query

```js
event.dataset: azure.auditlogs
    and (
      azure.auditlogs.operation_name: "User has elevated their access to User Access Administrator for their Azure Resources" or
      azure.auditlogs.properties.additional_details.value: "Microsoft.Authorization/elevateAccess/action"
    ) and event.outcome: "success"
```

**Framework**: MITRE ATT&CKTM

- Tactic:

- Name: Privilege Escalation

- ID: TA0004

- Reference URL: [https://attack.mitre.org/tactics/TA0004/](https://attack.mitre.org/tactics/TA0004/)

- Technique:

- Name: Account Manipulation

- ID: T1098

- Reference URL: [https://attack.mitre.org/techniques/T1098/](https://attack.mitre.org/techniques/T1098/)

- Sub-technique:

- Name: Additional Cloud Roles

- ID: T1098.003

- Reference URL: [https://attack.mitre.org/techniques/T1098/003/](https://attack.mitre.org/techniques/T1098/003/)

- Tactic:

- Name: Persistence

- ID: TA0003

- Reference URL: [https://attack.mitre.org/tactics/TA0003/](https://attack.mitre.org/tactics/TA0003/)

- Technique:

- Name: Account Manipulation

- ID: T1098

- Reference URL: [https://attack.mitre.org/techniques/T1098/](https://attack.mitre.org/techniques/T1098/)

- Sub-technique:

- Name: Additional Cloud Roles

- ID: T1098.003

- Reference URL: [https://attack.mitre.org/techniques/T1098/003/](https://attack.mitre.org/techniques/T1098/003/)

[« Azure RBAC Built-In Administrator Roles Assigned](/content/guide/en/security/current/prebuilt-rule-8-19-20-azure-rbac-built-in-administrator-roles-assigned.html)[Entra ID Domain Federation Configuration Change »](/content/guide/en/security/current/prebuilt-rule-8-19-20-entra-id-domain-federation-configuration-change.html)

On this page

- [Investigation guide](/content/guide/en/security/current/prebuilt-rule-8-19-20-entra-id-elevated-access-to-user-access-administrator.html#_investigation_guide_6425/index.html)
- [Rule query](/content/guide/en/security/current/prebuilt-rule-8-19-20-entra-id-elevated-access-to-user-access-administrator.html#_rule_query_7293/index.html)

Most Popular

Video

[Get Started with Elasticsearch](/content/webinars/getting-started-elasticsearch?page=docs&placement=top-video/index.html)

Video

[Intro to Kibana](/content/webinars/getting-started-kibana?page=docs&placement=top-video/index.html)

Video

[ELK for Logs & Metrics](/content/webinars/introduction-elk-stack?page=docs&placement=top-video/index.html)

Was this helpful?Feedback

LikeDislike

Thank you for your feedback.

a18132920325.cdn.optimizely.com

# a18132920325.cdn.optimizely.com is blocked

This page has been blocked by an extension

- Try disabling your extensions.

ERR\_BLOCKED\_BY\_CLIENT

Reload

This page has been blocked by an extension