Detects when an Entra ID (Azure AD) application (service principal) assigns itself to a privileged directory role, which is atypical and may indicate credential compromise and privilege escalation. The rule inspects Azure audit logs for role-assigning events where an acting service principal (azure.auditlogs.properties.initiated_by.app.servicePrincipalId) assigns a role to a member, and then validates that the acting principal is the same as the target resource, i.e., a self-assignment. It extracts the role name from the event payload and normalizes it, then checks against a comprehensive list of privileged or high-impact roles (e.g., Global Administrator, Exchange Administrator, SharePoint Administrator, Intune Administrator, etc.). If a match is found, the alert fires. The detection is anchored to specific Azure Audit Logs operations that indicate role assignment or privilege changes and is mapped to MITRE ATT&CK techniques for Privilege Escalation (T1078, including Cloud Accounts T1078.004 and Account Manipulation T1098.003) and Persistence (TA0003). The rule includes investigation guidance, false positives, and remediation steps, emphasizing that such self-assignments should be investigated, credentials rotated, and vendor or automation onboarding cases excluded. It also highlights the risk of compromised vendor credentials being reused across tenants and suggests checking ownership, cross-tenant occurrences, and related credential changes (e.g., client secrets, certificates). Data sources are Azure audit logs from Entra ID, and the rule is tuned for security operations workflows with a detailed triage path, including owner verification and cross-tenant checks.