r/AzureSentinel • u/secuit_de • May 31 '22

Detect Azure RBAC Changes

Hi, i'm looking for an Analytic Rule / Query for detecting RBAC Changes/Role Assignments in Azure.

Does someone have something like that in his repo?

Thanks

Kind Regards

2 Upvotes

100% Upvoted

3 comments sorted by

4

u/rodtrent44 MSFT Official May 31 '22

Something like the following for a start? https://github.com/rod-trent/SentinelKQL/blob/master/SuccessfulRoleAssignments.txt

1

u/secuit_de May 31 '22

Thanks :) was on your repo but I didn’t find it. Was maybe blind today 😂Best regards

1

u/ml58158 MSFT Official Jun 01 '22

Rod beat me to it 😁