Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1098-account-manipulation

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects when the approval requirement on an Entra Identity Governance access package assignment policy is disabled.

Strategy

This rule monitors Microsoft Entra audit logs for the Update access package assignment policy activity, where a targetResources modified property with modifiedProperties.displayName of IsApprovalRequiredForAdd is set to a modifiedProperties.newValue of False. Access packages in Identity Governance bundle roles, group memberships, and application access into a single assignable unit, and each package is governed by an assignment policy that can require manager or resource-owner approval before a user is granted access. Setting IsApprovalRequiredForAdd to False removes that approval gate, allowing any user in the eligible scope to self-assign the underlying access without human review.

Triage & Response

• Examine whether {{@ocsf.actor.user.uid}} is an Identity Governance or Entra ID administrator with a legitimate reason to modify assignment policy approval settings.
• Identify which access package the modified policy governs and what roles, groups, or application access it grants.
• Check whether {{@ocsf.actor.user.uid}} or other actors used the newly unapproved self-assignment path to grant themselves or others elevated access.
• Determine if the policy change was reverted or if approval remains disabled, and confirm whether a change ticket or governance request authorized the modification.
• Review other recent administrative activity by {{@ocsf.actor.user.uid}} to identify additional configuration changes that may indicate broader account compromise or insider misuse.