Are changes to administrator accounts reported automatically?
Logging tells you what happened. Alerting tells you while it is happening. This question is about the second one.
What the carrier is actually asking
The carrier is asking whether the creation of a new administrator, the addition of an account to a privileged group, or a change to an existing administrator produces a notification to a human, automatically, without anyone reviewing a log. Privilege escalation is one of the few attacker actions that is both unmistakable and early enough to matter.
Why it is underwritten
Adding an administrative account is a step almost every serious intrusion takes, and it is a step legitimate operations take rarely. That ratio makes it an unusually high-signal alert. Carriers ask because organisations that detect at this stage have contained incidents rather than claims.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Entra ID has this built in, and it is off or unrouted more often than not.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Entra ID | Privileged Identity Management alerts and role assignment notifications | Notifications enabled for role assignment and activation, delivered to a monitored mailbox or channel rather than to an individual |
| Entra ID | Identity Protection risk detections and risky user alerts | Configured and routed, so anomalous administrator behaviour surfaces alongside assignment changes |
| Microsoft 365 | Purview alert policies for role changes and elevation of privilege | Active alert policies covering administrator role assignment, with recipients that are still employed |
| Azure | Activity log alerts on role assignment write operations | An alert rule on Microsoft.Authorization/roleAssignments/write at subscription scope, since resource-plane privilege changes are separate |
| Any | The destination of the alerts | A monitored destination with an owner. An alert to an unread distribution list is a log entry with extra steps |
The most common way this control fails is not a missing rule. It is a rule that has been firing for two years into a mailbox belonging to someone who left. Verifying the destination is part of verifying the answer.
What a defensible yes requires
- Privileged role assignment and activation generate notifications automatically.
- Notifications reach a monitored destination with a named owner and a response expectation.
- Azure role assignment changes are alerted separately from directory role changes.
- Someone has tested the alert path recently by making a change and confirming it arrived.
- The response to an unexpected alert is defined, so the notification leads somewhere.
How this answer goes wrong
Organisations answer yes because the capability exists and the checkbox is ticked, without testing delivery. The second failure is coverage: directory role alerts configured, Azure resource-plane role assignments not, so an attacker granting themselves Owner on the production subscription produces no notification at all.
Frequently asked
Is a weekly report enough?
It is better than nothing and it is not what the question asks. Automatically reported means at the time of the change, because the value of the signal decays quickly.
What if we have no security operations centre?
The alert still belongs somewhere a person looks daily. A shared channel monitored by the IT team is a legitimate answer for a smaller organisation, and far better than a dedicated mailbox nobody opens.
Should service principal permission grants alert too?
Yes, and few organisations do it. Consent to a high-privilege application is an escalation path that bypasses directory roles entirely.
How do we prove this to an underwriter?
A dated example alert, with the configuration that produced it, is the most convincing artefact. It shows the rule exists, fires, and lands where you say it does.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture