App Granted Privileged Delegated Or App Permissions
Detects when an administrator grants an application either application permissions (app roles) or highly privileged delegated permissions within an Azure environment. This action is logged in the Azure audit logs as 'Add app role assignment to service principal'. Such assignments can lead to persistence or privilege escalation if abused.
Sigma
