Rules Contributing to Microsoft Entra PIM Setting Changed Alert

The following rules are used to identify suspicious Microsoft Entra PIM setting changed. Any one or more of these will trigger the Microsoft Entra PIM Setting Changed Alert. Details for each rule can be viewed by clicking the More Details link in the description.

Title

Description

Changes to PIM Settings

Detects when changes are made to PIM roles

PIM Alert Setting Changes to Disabled

Detects when PIM alerts are set to disabled.