title: Granting Of Permissions To An Account
id: a622fcd2-4b5a-436a-b8a2-a4171161833c
status: experimental
author: sawwinnnaung
date: 2020/05/07
description: Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
references:
  - https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AzureActivity/Granting_Permissions_To_Account_detection.yaml
logsource:
  service: AzureActivity
detection:
  keywords: 
    - Microsoft.Authorization/roleAssignments/write
  condition: keywords
level: medium
falsepositives:
  - Valid change
tags:
  - attack.t1098
