Overview

This detection rule monitors for external users (guest accounts) being granted eligibility for high-privileged administrator roles through Privileged Identity Management (PIM). This is a critical security event that requires immediate attention, as external accounts with administrative privileges pose significant security risks to your Azure AD tenant.

Rationale

Guest accounts are external users from other organizations or personal email domains (such as Gmail, Hotmail, or Live) who have been invited to access your Azure AD tenant. While guest access is a legitimate business requirement in many scenarios, granting administrative privileges to external accounts creates substantial security risks:

• Expanded Attack Surface: External accounts may have weaker security controls than your organization's internal accounts
• Limited Visibility: Your organization has reduced visibility and control over external accounts' security posture
• Persistence Mechanism: Attackers often use external account elevation as a way to maintain long-term access to compromised environments
• Compliance Concerns: Many regulatory frameworks require strict controls over privileged access, especially for external entities

This rule specifically monitors PIM role assignments because PIM is often used to grant temporary or just-in-time administrative access, making it a common target for attackers seeking to escalate privileges.

Investigation Steps

When this alert triggers, follow these investigation steps:

1. Verify the Legitimacy: Confirm with the administrator who performed the action whether this was intentional and authorized
2. Review the External User: Examine the guest account details, including their email domain and invitation history
3. Check Role Permissions: Understand what privileges the assigned role provides and whether they are appropriate for the business need
4. Review Timing: Consider whether the timing of this action aligns with legitimate business activities
5. Examine Context: Look for other suspicious activities from the same administrator or involving the same guest account
6. Validate Business Justification: Ensure there is a legitimate business case for granting these privileges to the external user

Additional Resources

1. Azure AD Privileged Identity Management documentation
2. Azure AD B2B collaboration and guest users
3. PIM Security Wizard
4. Access reviews for external users