KQL - Microsoft Entra PIM Role Eligibility & Activation Review
Correlates Microsoft Entra Privileged Identity Management (PIM) role eligibility with actual activation activity to identify how privileged roles are being used across the environment. The query combines eligible PIM assignments with activation events and submitted business justifications, allowing security teams to determine which privileged roles are frequently activated, rarely used, or never activated. This is useful for privileged access reviews, least-privilege initiatives, role cleanup exercises, and validating whether users are providing meaningful activation justifications.
Microsoft Sentinel (KQL)
