KQL - PIM Activation Justification Review
Reviews Microsoft Entra Privileged Identity Management (PIM) role activations and correlates them with activation justifications supplied by users. The query allows security teams to identify: Who is activating privileged roles Which roles are being activated How often activations occur When activations occurred Business justifications provided during activation requests This is useful for privileged access reviews, audit preparation, compliance reporting, least-privilege initiatives, and identifying users who repeatedly activate privileged roles with weak or repetitive justifications.
Microsoft Sentinel (KQL)
