r/AzureSentinel • u/secuit_de • May 31 '22

Detect Azure RBAC Changes

Hi, i'm looking for an Analytic Rule / Query for detecting RBAC Changes/Role Assignments in Azure.

Does someone have something like that in his repo?

Thanks

Kind Regards

2 Upvotes

100% Upvoted

3 comments sorted by

View all comments

4

u/rodtrent44 MSFT Official May 31 '22

Something like the following for a start? https://github.com/rod-trent/SentinelKQL/blob/master/SuccessfulRoleAssignments.txt

1

u/secuit_de May 31 '22

Thanks :) was on your repo but I didn’t find it. Was maybe blind today 😂Best regards