Microsoft.Directory/groups/members/update

CSP: Azure

Tactics:

Privilege Escalation Persistence

Techniques:

T1098

Tags:

Azure Microsoft Entra ID

Event

Adds or removes members from an Entra ID security group or Microsoft 365 group.

Security Context

• Adding users to privileged groups is a common persistence technique that grants broad permissions while appearing as routine administration.

Log Source

Entra ID Audit Logs

Sample Event

MITRE ATT&CK Mapping

Tactics: Privilege Escalation Persistence

Techniques:

• T1098 — Account Manipulation — Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.