Azure Privileged Identity Management (PIM) provides just-in-time access to privileged roles. A PIM activation alert fires when an eligible user activates a high-privilege role (Global Administrator, User Administrator, Security Administrator). Suspicious indicators include activation outside business hours, self-approval where the policy should require manager approval, and Global Administrator activation without a business justification matching an open ticket.
PIM activations are logged in Entra ID Audit Logs under the PrivilegedIdentityManagement category and in AzureActivity under role assignment operations.
☰ Table of Contents
01 — BACKGROUND
TECHNIQUE OVERVIEWPIM requires eligible users to explicitly activate a role before they have permissions. Role activation typically requires MFA, a business justification, and optionally manager approval. Attackers who compromise an account with PIM eligibility can activate high-privilege roles to gain access to critical resources. Self-approval abuse occurs when PIM policies are misconfigured to allow self-approval without a second approver for critical roles.
| Field | Value |
|---|---|
| MITRE Technique | T1078.004 — Cloud Accounts, T1548 — Abuse Elevation Control Mechanism |
| Log Sources | AuditLogs (Entra ID), AzureActivity |
| Operation Names | Add member to role (PIM activation), Eligible member added/removed |
| High-Risk Roles | Global Administrator, Privileged Role Administrator, User Administrator, Security Administrator |
| Detection Priority | HIGH — all Global Admin PIM activations require SOC review |
02 — IDENTIFICATION
2 INDICATORSEntra ID Audit Logs capture every PIM role activation with the activating user, the role name, the justification text submitted, and whether approval was required. Outside-hours activations (weekends, nights) of Global Administrator or Privileged Role Administrator warrant immediate verification with the account owner.
- 1Navigate to Entra ID → Identity Governance → Privileged Identity Management → Azure AD roles → Audit history.
- 2Filter by Activity: Add member to role (PIM activation) and time range Last 24 hours.
- 3Review Initiated by (activating user), Target (role name), and Reason (justification submitted). Absent or generic justifications are suspicious.
- 4Note the activation timestamp — convert to the user's local timezone. Activations at 2–4 AM local time are high-risk indicators.
- 5Run the KQL below to cross-correlate the PIM activation with subsequent actions performed during the elevated session (next 8 hours).
| Indicator | Meaning | Action |
|---|---|---|
| Global Admin + no ticket | Highest risk PIM role activated without matching change ticket | ESCALATE NOW |
| Outside hours (10PM-6AM) | Activation during non-business hours — possible compromised account | Contact user immediately |
| Self-approval on critical role | PIM policy misconfigured — no second approver required | Fix policy + investigate |
| Unusual location/IP | Activation from country not previously used by this account | ESCALATE |
The key risk is not the PIM activation itself but what the user did while elevated. An attacker who activates Global Administrator may create a backdoor account, add a new Global Admin, disable MFA for existing accounts, or read/export sensitive directory data. These post-activation actions are logged in AuditLogs and AzureActivity.
- 1Navigate to Entra ID → Monitoring → Audit logs. Filter by the activating user and the time window of the PIM session (activation time to deactivation/expiry).
- 2Look for high-risk operations:
Add user,Reset user password,Add member to role(adding others to admin roles),Update user(disabling MFA),Add application. - 3Check AzureActivity for any Resource Group operations, Key Vault access, or Storage account operations during the elevated session.
- 4Run the KQL below to list all audit events from the activating user during the elevated window.
- 5If backdoor accounts or additional admin role assignments are found, these are definitive indicators of an attack — escalate immediately.
PIM activation by a Privileged Role Administrator (not Global Admin) is equally dangerous — Privileged Role Administrators can grant Global Admin PIM eligibility to any account, including newly created ones. Always check for new PIM eligibility assignments during the elevated session.
03 — CONTAINMENT
IMMEDIATE ACTION- 1Manually deactivate the PIM role: PIM → Azure AD roles → Active assignments → [User/Role] → Deactivate.
- 2If the account is compromised: Entra ID → Users → [User] → Block sign-in and revoke all sessions.
- 3Remove any backdoor accounts created during the session: Users → filter by creation date matching the session window → Delete.
- 4Remove any role assignments added during the session that are not authorized.
- 5Review and revert any PIM eligibility assignments added during the session.
04 — ERADICATION
CLEANUP- 1Update PIM settings for Global Administrator and Privileged Role Administrator: require manager approval (not self-approval) and enforce MFA during activation.
- 2Set activation maximum duration to 4 hours for highly privileged roles — shorter windows reduce the blast radius of a compromised activation.
- 3Enable PIM alerts: PIM → Alerts — ensure "Roles are being activated too frequently" and "Roles don't require MFA" alerts are active.
- 4Review all accounts with Global Admin PIM eligibility — remove eligibility from any account that does not have a documented business need.
- 5Create a Sentinel analytics rule to alert on all Global Admin and Privileged Role Admin PIM activations for continuous SOC review.
- Compromised PIM session deactivated and account disabled
- All backdoor accounts and unauthorized role assignments removed
- PIM policy updated to require approval for critical roles
- Global Admin eligibility list audited and trimmed
- Sentinel alert rule created for future Global Admin activations
05 — ESCALATION
ESCALATION PATHS| Condition | Severity | Action | Notify |
|---|---|---|---|
| Backdoor account or Global Admin granted during session | SEV1 | Full IR, disable all involved accounts, forensic audit | SOC Lead → CISO → IT Security |
| Outside-hours activation, user unresponsive | SEV1 | Block account, revoke session, await user verification | SOC Lead → CISO → Manager |
| Self-approval on critical role, no ticket | SEV2 | Verify with user, fix PIM policy, document | SOC Lead → IAM Team |
| Authorized after-hours incident response | INFO | Confirm with on-call ticket, document, close | None |
Stay Threat-Ready
Follow CyberHawk Threat Intel for daily SOC analyst playbooks, detection engineering guides, and threat intelligence.