KQL - Microsoft Entra PIM Role Utilization Dashboard
Provides a role-centric view of Microsoft Entra Privileged Identity Management (PIM) usage by correlating role eligibility, activation history, and recently activated assignments. The query helps security and identity teams understand: Which privileged roles have the most eligible users. Which roles are actively being used. Which roles are rarely or never activated. Which users currently hold activated privileged access. How broadly privileged roles are distributed across the organization. This is useful for privilege governance reviews, role rationalization, least-privilege initiatives, and identifying over-provisioned privileged access.
Microsoft Sentinel (KQL)
