Whos Activating Roles Via PIM

PIM role activations from `AuditLogs` — useful for tracking privileged-role usage.

KQL Library  /  Identity

 Identity whos-activating-roles-via-pim.kql

PIM role activations from `AuditLogs` — useful for tracking privileged-role usage.

Tactics Privilege Escalation
Techniques T1078.004 T1098.003
Platforms Entra ID
Data AuditLogs
Deep Dive  Deep Dive
 Deep Dive  Download .kql 
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// Source: KQL Toolbox #6: From Junk Clicks To Identity & Privilege Control (2026-01-31) — https://www.hanley.cloud/2026-01-31-KQL-Toolbox-6-From-Junk-Clicks-to-Identity-%26-Privilege-Control/
// Great for tracking PIM activations
// Tactics: Privilege Escalation
// Techniques: T1078.004, T1098.003
// Platforms: Entra ID
// Data: AuditLogs

AuditLogs
| where Category == "RoleManagement"
| where ActivityDisplayName == "Add member to role completed (PIM activation)"
| extend Actor = tostring(parse_json(InitiatedBy).user.displayName)
| extend IP = tostring(parse_json(InitiatedBy).user.ipAddress)
| extend Role = tostring(parse_json(TargetResources)[0].displayName)
| extend ActivationTime = TimeGenerated
| project Actor, Role, ActivationTime, IP