Skip to content
Azure Forensics

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.

Glossary

Role assignment (Azure RBAC)

The Azure RBAC binding of a principal, a role definition and a scope. Creating one is the Activity Log operation Microsoft.Authorization/roleAssignments/write.

An Azure role assignment grants a role (Owner, Contributor, Reader, Storage Blob Data Reader…) to a principal — user, group, service principal or managed identity — at a scope: management group, subscription, resource group or resource.

Creating one is logged in the Activity Log as Microsoft.Authorization/roleAssignments/write, with the principal, role definition ID and scope in the request body. Principals with Owner, User Access Administrator or Role Based Access Control Administrator can create assignments, which makes them the main privilege-escalation path in Azure (MITRE T1098.003).

See Azure role assignment abuse and elevateAccess.

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.