Azure PIM Just-in-Time Role Activation Request

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects HTTP POST requests to graph.microsoft.com with the URI containing 'roleAssignmentScheduleRequests'. This pattern is indicative of an Azure PIM (Privileged Identity Management) Just-in-Time role activation request, which is a mechanism for users to temporarily elevate their privileges within Azure AD. While a legitimate administrative action, it can also be used by attackers for privilege escalation.