Azure PIM Role Activated Too Frequently

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•20

Identifies when the same privilege role has multiple activations by the same user, which could indicate an attempt to bypass time-based access restrictions or an adversary repeatedly activating a role for malicious purposes. This alert is triggered by the 'sequentialActivationRenewalsAlertIncident' risk event type in Azure PIM.