title: Granting Of Permissions To An Account
id: a622fcd2-4b5a-436a-b8a2-a4171161833c
status: test
description: Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
author: sawwinnnaung
references:
  - https://github.com/Azure/Azure-Sentinel/blob/master/Detections/azureactivity/Granting_Permissions_To_Account_detection.yaml
date: 2020/05/07
modified: 2021/11/27
logsource:
  product: azure
  service: azureactivity
detection:
  keywords:
    - Microsoft.Authorization/roleAssignments/write
  condition: keywords
falsepositives:
  - Valid change
level: medium
tags:
  - attack.t1098