Microsoft Entra user removed from restricted management administrative unit
Description
AlphaSOC detected a user being removed from a restricted management
administrative unit (AU) in Microsoft Entra ID via the
Remove member from restricted management administrative unit audit action.
Restricted AUs protect members from changes by administrators without
appropriate roles scoped to a restricted AU containing the member. Removing a
user can lift that protection and may precede an unauthorized password reset or
other account changes. The same audit action can also report the removal of
security groups or devices from a restricted AU.
Impact
If the removed member no longer belongs to any restricted AU, administrators with appropriate tenant-level permissions can manage it again. An attacker with such privileges may reset a user's credentials, change account settings, or take over the account. Removing a security group or device can similarly expose it to changes by tenant-level administrators.
Severity
| Severity | Condition |
|---|---|
Low | User removed from a restricted management administrative unit |
Medium | User removed with an unexpected action, source ASN, or user agent |
Investigation and Remediation
Review Entra audit logs for the
Remove member from restricted management administrative unit event. Identify
the acting identity, removed member and its object type, and affected AU. Verify
that the removal was authorized and check whether the member remains in another
restricted AU. For users, review subsequent password resets, authentication
method changes, and sign-ins. For groups or devices, review subsequent
membership, ownership, and property changes.
If unauthorized, restore the member's approved AU membership and reverse any malicious changes. Revoke sessions and reset credentials if a user account was compromised. Investigate the acting identity and review other changes to restricted AU membership.