Anomalous PIM Privileged Role Activation in Entra ID
Detects potentially unauthorized or anomalous activations of highly privileged Entra ID roles (e.g., Global Administrator). The rule identifies activations that lack a business justification, occur during unusual hours (outside of 06:00-22:00), or exhibit burst patterns of repeated activation/deactivation cycles which may indicate automated credential abuse or persistence attempts.
Microsoft Sentinel (KQL)
