This rule detects when a privileged Microsoft Entra ID (Azure AD) directory role is assigned from one account to another. The actor can be a user or a service principal, and the member can be a user or a service principal. Privileged roles provide administrator control over tenant services, so such cross‑account role assignments can signal persistence or credential abuse. The detection accounts for both direct role assignments and Privileged Identity Management (PIM) operations; PIM events that record only the role (without the member) are excluded unless the corresponding direct assignment is present. The rule parses Azure Audit Logs to derive the actor, member, and role, then matches the role against a curated list of privileged roles (exact matches, including built‑in and other high‑privilege roles). It triggers when the actor and member are distinct and the operation indicates a successful role assignment. The alert includes contextual signals (who initiated the assignment, who received it, the role, and the tenant), and supports investigation with fields such as actor_id, member_id, and role_name. MITRE ATT&CK mappings include T1078 (Cloud Accounts) and T1098 (Account Manipulation) under Privilege Escalation and Persistence. False positives include planned onboarding or identity governance/provisioning tooling. Remediation guidance covers revoking the assignment, revoking sessions, credential reviews, and applying exceptions for expected administrators or provisioning accounts.