introduction
after we have seen how to configure PIM approaches like :
- Just in Time ( Eligible Role )
- Time Bound Access
- Permanent active Access
it’s very important to be familiar with PIM audit logs and alerts to keep monitoring administrative activities at your organization
PIM Audit Logs
With Azure Active Directory (Azure AD) Privileged Identity Management (PIM), you can view:
- activity,
- activations,
- and audit history
- subscriptions,
- resource groups,
- and even virtual machines.
Any resource within the Azure portal that leverages the Azure role-based access control functionality can take advantage of the security and lifecycle management capabilities in Privileged Identity Management.
Resources Audit Logs
Resource audit gives you a view of all role activity for a resource.
Open Azure AD Privileged Identity Management.
Select Azure resources.
Select the resource you want to view audit history for.
Select Resource audit.
Filter the history using a predefined date or custom range.
My audit logs
My audit enables you to view your personal role activity.
Open Azure AD Privileged Identity Management.
Select Azure resources.
Select the resource you want to view audit history for.
Select My audit.
Filter the history using a predefined date or custom range.
View Roles members
Open Azure AD Privileged Identity Management.
Select Azure resources.
you can see briefly all resources members
Select the resource you want to view activity and activations for.
Select Roles or Members.
Select a user.
PIM Alerts
Privileged Identity Management (PIM) generates alerts when there is suspicious or unsafe activity in your Azure Active Directory (Azure AD) organization.
When an alert is triggered, it shows up on the Alerts page
for example below you will see alert indicating that roles don’t require MFA : which could be considered as risk
Alerts Severity
alert classified into three categories
High:
- Requires immediate action because of a policy violation.
Medium:
- Does not require immediate action but signals a potential policy violation.
Low:
- Does not require immediate action but suggests a preferred policy change.
