Unexpected Microsoft Entra activity indicating administrative unit creation
Description
AlphaSOC detected the creation of a Microsoft Entra ID administrative unit (AU)
without restricted management via the Add administrative unit audit action.
The activity has an unexpected action, source ASN, or user agent. Administrative
units scope delegated administration to specific users, groups, and devices. An
attacker may create an AU as a first step toward establishing persistent access
through scoped role assignments.
Impact
An unauthorized AU can provide a scope for subsequent role assignments that give an attacker administrative control over selected accounts or resources. Creating the AU alone does not grant these permissions, but later membership and role changes may enable account manipulation or persistent access.
Severity
Unexpected properties include the action, source ASN, and user agent.
| Severity | Condition |
|---|---|
Informational | Administrative unit created with one unexpected property |
Low | Administrative unit created with two unexpected properties |
Medium | Administrative unit created with three unexpected properties |
Investigation and Remediation
Review Entra audit logs for the Add administrative unit event. Identify the
creating identity and the new AU, then verify that its creation was authorized.
Review subsequent membership changes and scoped role assignments, especially if
the tenant does not normally use administrative units.
If unauthorized, remove associated malicious role assignments and restore the approved configuration. Delete the AU if it is not required and investigate the creating identity and affected accounts for additional malicious activity.