Forum Discussion
Azure AD detection User added to group vs User added to role
ceesmandjes If you look at the rule logic, you'll see that there are 2 conditions used. One for the Operation and the other for the Group Addition. So the rule in Sentinel is using a combination of these two conditions:
where OperationName in~ (OperationList)
where GroupName in~ (PrivilegedGroups)
The values in OperationList and PrivilegedGroups have also been defined.
AnuragSrivastava do you know how I make a distinction between groups and roles?
ceesmandjes if you wish to list out the for roles & groups, then the appropriate operation names are 'Add member to role', 'Add member to group'.
You can tweak the template rule which is mentioned above by adding these to the list, something like below (Note that, below is just a few first lines from default template rule as an example)
let timeframe = 1h;
let OperationList = dynamic(["Add member to role", "Add member to role", "Add member to group" ,"Add member to role in PIM requested (permanent)"]);
let PrivilegedGroups = dynamic(["UserAccountAdmins","PrivilegedRoleAdmins","TenantAdmins"]);
AuditLogs
| where TimeGenerated >= ago(timeframe)
| where LoggedByService =~ "Core Directory"
