Managed Sentinel – Alert 168

Alert IDMS-A168
Alert NameRoles added/removed in Azure AD
DescriptionThis alert identifies Azure AD operation related to adding or removing accounts from roles.
Severity LevelLow
Threat Indicator
MITRE ATT&CK TacticsPersistence
Log sourcesAuditLogs
False Positives
Recommendations