Changes To PIM Settings

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•33

Detects when changes are made to Privileged Identity Management (PIM) role settings within Azure Active Directory. This could indicate an attempt to alter how privileged roles are managed, potentially to facilitate unauthorized access or persistence.