KQL - After-Hours PIM Role Activation
Identifies Microsoft Entra Privileged Identity Management (PIM) role activations occurring outside normal business hours or during weekends. The query reviews role management audit events, converts timestamps to a defined local timezone, and highlights successful privileged role activations that occur outside business hours and on weekends. This detection helps security teams identify unusual, privileged access activity that may warrant additional investigation, especially for highly privileged roles.
Microsoft Sentinel (KQL)
