SOP-43: Azure PIM Elevation Response

SOC analyst SOP for suspicious Azure PIM role activations. Covers elevation triage, suspicious post-activation usage, and access revocation.

2026-07-18T06:51:48.422Z
Rudra Verma, Senior Security Architect & Researcher