Suspicious Azure API calls indicating service principal role assignment
Description
AlphaSOC detected a user requesting an Azure role assignment to a service
principal via Microsoft.Authorization/roleAssignments/write. The request
explicitly identifies the recipient as a service principal. Assignments
initiated by service principals are excluded. This detection observes the
request and does not confirm whether the assignment succeeded.
Attackers may grant roles to an application they control to establish persistent access to Azure resources independently of the compromised user's credentials.
Impact
If successful, an unauthorized role assignment grants the service principal access within the assigned scope. Depending on the role, an attacker may read sensitive data, modify resources, or grant further access. Resetting the acting user's password does not remove the service principal's permissions.
Severity
| Severity | Condition |
|---|---|
Informational | User requests a role assignment to a service principal |
Low | Assignment requested with an unexpected action or source ASN |
Medium | Assignment requested with both an unexpected action and source ASN |
Investigation and Remediation
Review Azure Activity logs for Microsoft.Authorization/roleAssignments/write
events. Identify the acting user, target service principal, role definition, and
scope. Correlate the request with subsequent events or inspect the current role
assignments to determine whether it succeeded. Verify that the assignment was
approved and required by the application.
If unauthorized, remove any resulting role assignment and review the service principal's owners, credentials, and recent activity. Revoke unauthorized credentials and investigate the acting user for compromise and other access changes.