Entra Agent User PIM Role Activation or Assignment
Detects PIM role activations and eligible or active role assignments that involve Entra agent users. Agents are identified by agentType, blueprintId or a maintained UPN list. Review notes: - The agentType and blueprintId branches are not validated against real agent user events. - The UPN list is the only validated signal. - The UPN list is manual and needs an owner and a review cadence. - For a scheduled analytic rule, set Lookback to match the run frequency (for example 1d). Entity mapping: Account: ActorUpn; Account: TargetUser (Actor intentionally not mapped).
Microsoft Sentinel (KQL)
