This detection watches Azure AD AuditLogs for the Update user operation and compares the modifiedProperties for the UserType field. It flags cases where oldValue contains Guest and newValue contains Member, indicating a guest account being promoted to a member. Legacy accounts with a null oldValue are excluded to avoid misclassifying historical promotions. The rule extracts the initiator (actor) and the target user, normalizes fields for readability, and outputs a finding with timing metadata. This activity corresponds to privilege escalation within a tenant by expanding the capabilities of a guest account to access broader resources. The rule maps to MITRE ATT&CK techniques related to account manipulation and valid cloud accounts, helping to detect potential attacker-controlled or compromised guest-to-member promotions.