Entra ID User Added to Role Outside PIM
This rule detects when a user is added to a role in Microsoft Entra ID (formerly Azure AD) outside of a Privileged Identity Management (PIM) process. While adding users to roles is a normal administrative action, performing it outside of PIM can indicate a potential security risk, as PIM provides just-in-time access and approval workflows for privileged roles. This rule specifically looks for "Add member to role outside of PIM (permanent)" events, which are often triggered via PowerShell API calls.
YARA-L
