Microsoft Entra Global or Cloud Device Administrator Role Assignment
Detects Microsoft Entra audit events where a user is added to either the Global Administrator or Cloud Device Administrator built-in roles, which are high-privilege administrative roles.
Cortex XDR
