EntraID - Privileged Identity Management - Role Settings Changes
Entra ID PIM Role Setting Changes
Query
AuditLogs
| where Category == "RoleManagement" or Category == "GroupManagement"
| where OperationName == "Update role setting in PIM"
| extend userPrincipalName = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)
| extend Role = case(
Category == 'RoleManagement',tostring(TargetResources[0].displayName),
"")
| extend Group = case(
Category == "GroupManagement", tostring(TargetResources[2].displayName),
"")
| mv-apply item = AdditionalDetails on (
where tostring(item.key) == "ipaddr"
| extend ipaddr = tostring(item.value)
)
| extend geo_ip = tostring(geo_info_from_ip_address(ipaddr))
| sort by TimeGenerated asc
| sort by TimeGenerated asc
| extend ChangedSettings = replace("Setting changes in this session: ", "", tostring(ResultReason))
| extend ModifiedSettings = extract_all(@"(.*?)\.", ChangedSettings)
| project-away ChangedSettings
| project
TimeGenerated,
Role,
Group,
ResultReason,
ModifiedSettings,
userPrincipalName,
Identity,
ipaddr,
geo_ip,
CorrelationIdAbout this query
Explanation
This query is designed to track changes made to role and group settings in Microsoft Entra's Privileged Identity Management (PIM). It specifically focuses on changes related to security settings, such as multi-factor authentication (MFA) requirements and approval processes. Here's a simplified breakdown of what the query does:
-
Data Source: It pulls data from audit logs related to role and group management activities.
-
Filter Criteria: The query filters for operations specifically related to updating role settings in PIM.
-
Extract Information:
- It identifies the user who initiated the change.
- It determines whether the change was related to a role or a group and captures the name of the role or group affected.
- It extracts the IP address from which the change was made and attempts to determine the geographical location of that IP address.
-
Sort and Organize: The results are sorted by the time the change was made.
-
Identify Changes: It extracts and lists the specific settings that were modified during the session.
-
Focus on MFA Changes: The query specifically highlights events where the "MFA on activation requirement" setting was changed.
In essence, this query helps administrators monitor and audit changes to critical security settings in Entra PIM, with a particular focus on changes to MFA requirements, which are crucial for maintaining secure access controls.
Details
Alex Verboon
Released: May 25, 2025
Tables
Keywords
Operators