Azure AD PIM Elevation Approval or Denial

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•36

Detects when a Privileged Identity Management (PIM) elevation request is approved or denied within Azure AD. This rule helps monitor critical administrative actions related to privilege escalation. Any approvals or denials outside of expected administrative operations should be investigated as they could indicate unauthorized privilege management or attempts to bypass security controls.