Azure AD Privileged Role Assignment Outside PIM

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•33

This rule identifies when a privileged role assignment occurs in Azure Active Directory (now Microsoft Entra ID) without utilizing Privileged Identity Management (PIM). Such assignments bypass the just-in-time access and approval workflows provided by PIM, potentially indicating an attacker attempting to establish persistent privileged access or escalate privileges outside of established security controls.