title: Directory Role or App Role Granted to a Service Principal
id: 6f2d1c3e-8a4b-4f7e-9c21-3b5d7e9a1c05
status: experimental
description: A directory role (e.g. Global Administrator) or app role was assigned to a service principal. Microsoft observed self-assignment of Global Administrator by a ConnectWise management application.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
author: Cybaverse
date: 2026-10-22
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1098.003
logsource:
    product: azure
    service: auditlogs
detection:
    selection_role:
        OperationName: 'Add member to role'
        TargetResources|contains: 'ServicePrincipal'
    selection_approle:
        OperationName: 'Add app role assignment to service principal'
    condition: 1 of selection_*
falsepositives:
    - Onboarding of legitimate automation or vendor apps
level: high