Azure PIM Role Activation Without MFA

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•35

This rule identifies a critical security misconfiguration or bypass scenario within Azure Privileged Identity Management (PIM) where a privileged role can be activated without requiring multi-factor authentication (MFA). This can significantly increase the risk of unauthorized access and privilege escalation if an attacker compromises credentials for an account with PIM roles.