User Becomes Admin (Non-PIM) [RULE-1131]

Rationale

Administrative role assignments in Microsoft Entra ID should be carefully controlled and audited. When a user receives high privileges for the first time, that represents a significant change in their access level and warrants verification. Because there is no just-in-time activation or approval workflow available in this tenant, the privileges take effect immediately and remain active until someone removes them.

An attacker who has compromised an existing administrator account may elevate a regular user account to administrative privileges as a persistence mechanism. By creating a new administrator, the attacker ensures continued access even if the originally compromised account is discovered and remediated. This technique aligns with MITRE ATT&CK T1098 (Account Manipulation), specifically the sub-technique T1098.003 (Additional Cloud Roles), where adversaries add roles to cloud accounts to maintain access and escalate privileges.

First-time administrative role assignments are particularly noteworthy because they represent a departure from a user's established access pattern. In a tenant without PIM, the list of accounts holding administrative roles is the full set of privileged access at any given moment, so keeping that list small, deliberate, and well understood is the main control available.

Follow-up

Follow these steps to adequately address this detection:

1. Verify with the administrator listed in the alert whether they intentionally granted high privileges to the user. Check if there is a documented change request or business justification for the role assignment.
   • If no: The privilege escalation was not authorized and may indicate a compromised administrator account:
     1. Immediately remove the user from the high privilege role via the Entra admin center under Roles and administrators.
     2. Investigate the administrator account that performed the role assignment: review sign-in logs for suspicious activity, check for unfamiliar IP addresses or locations, and revoke active sessions.
     3. Review the Unified Audit Log at security.microsoft.com for additional unauthorized changes made by either the newly elevated account or the administrator who performed the assignment.
     4. If the administrator account appears compromised, reset its credentials and enforce MFA re-registration. Contact Attic for incident response support if the scope of compromise extends beyond the identified accounts.
   • If yes: The role assignment was intentional:
     1. Verify that the assigned role follows the principle of least privilege. Confirm the user has not been granted broader permissions than their responsibilities require -- a narrower role is often sufficient.
     2. Ensure the new administrator has MFA configured, is covered by your administrator Conditional Access policies, and is aware of their responsibilities.
     3. Review the full list of accounts holding administrative roles periodically and remove assignments that are no longer needed. If just-in-time administrative access is a requirement for your organization, this needs Entra ID P2, which enables PIM.
     4. If the assignment is acceptable and documented: close the incident.

More information

• Microsoft Learn: Microsoft Entra built-in roles
• Microsoft Learn: Best practices for Microsoft Entra roles
• Microsoft Learn: Manage emergency access accounts
• MITRE ATT&CK T1098 - Account Manipulation
• MITRE ATT&CK T1098.003 - Additional Cloud Roles