Unexpected Azure API calls indicating policy assignment creation or modification
Description
AlphaSOC detected the successful creation or modification of an Azure Policy
assignment via Microsoft.Authorization/policyAssignments/write. Policy
assignments define which policies apply to resources within a given scope.
Attackers with sufficient privileges may alter assignments to weaken security
controls or deploy unwanted changes to resources.
Impact
Unauthorized policy assignments can change security requirements across a management group, subscription, or resource group. Depending on the policy and its configuration, an attacker may weaken enforcement, modify resources, or trigger deployments using the assignment's managed identity.
Severity
| Severity | Condition |
|---|---|
Informational | Policy assignment created or modified |
Low | Assignment changed with an unexpected action or source ASN |
Medium | Assignment changed with both an unexpected action and source ASN |
Investigation and Remediation
Review Azure Activity logs for Microsoft.Authorization/policyAssignments/write
events. Identify the acting identity, assigned policy, scope, parameters, and
enforcement settings. Compare the assignment with the approved configuration and
check any associated managed identity and remediation tasks.
If unauthorized, remove the assignment or restore its approved configuration. Review resources affected by the policy for unwanted changes and investigate the acting identity for signs of compromise.
Known False Positives
- Authorized Microsoft Defender for Cloud or built-in policy initiative assignments
- Approved infrastructure as code deployments that create or update policy assignments