All Detections

Azure PIM Just-in-Time Role Activation

avatar
Darshan Thummar@Mighty
updated Jun 14, 2026003

Detects suspicious Azure PIM role activation requests for temporary elevated access

Microsoft Sentinel (KQL)