SOP-19: Entra ID Privileged Role Assignment Abuse Response

Analyst playbook for detecting and responding to unauthorised Entra ID privileged role assignments. Portal navigation for Audit Logs, PIM, and Entra Roles blade — manual triage steps, key indicator codes, KQL for Sentinel, SPL for Splunk, and full containment guidance.