Invalid PIM License Alert in Azure

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•27

This rule identifies when an organization's Azure Privileged Identity Management (PIM) service detects an 'invalidLicenseAlertIncident'. This indicates that the necessary Microsoft Entra Premium P2 or Microsoft Entra ID Governance license for PIM is either missing or has expired, leading to non-compliance and potential security risks related to privileged access management.