Query

AuditLogs
| where OperationName == "Add member to role completed (PIM activation)"
| summarize TotalActivations = count() by Identity
| sort by TotalActivations
| render columnchart

About this query

Visualization of successful PIM activiations

Query Information

Description

This query visualises the PIM activation performed by accounts. A user who has used many different PIM roles may be interesting to examine, it could be that a users always asigns their PIM access rights without needing them all the time. The same goes for PIM roles with high privileges.

References

https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/

Sentinel

Explanation

This query is designed to create a visual representation of successful Privileged Identity Management (PIM) activations. Here's a simple breakdown of what it does:

Data Source: It uses the AuditLogs table, which contains logs of various operations.
Filter: It filters the logs to only include entries where the operation name is "Add member to role completed (PIM activation)". This means it focuses on successful activations of PIM roles.
Summarization: It counts the total number of these activations for each user (referred to as Identity).
Sorting: The results are sorted by the total number of activations, from lowest to highest.
Visualization: Finally, it displays the data as a column chart, making it easy to see which users have the most PIM activations.

The purpose of this query is to identify users who frequently activate PIM roles, which might warrant further investigation to ensure they are using these roles appropriately and not over-assigning themselves high-privilege roles unnecessarily.

KQL Search