Managed Sentinel – Alert 168
| Alert ID | MS-A168 |
| Alert Name | Roles added/removed in Azure AD |
| Description | This alert identifies Azure AD operation related to adding or removing accounts from roles. |
| Severity Level | Low |
| Threat Indicator | |
| MITRE ATT&CK Tactics | Persistence |
| Log sources | AuditLogs |
| False Positives | |
| Recommendations |