> For the complete documentation index, see [llms.txt](https://docs.bsure.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bsure.io/user-guides/security/pim-role-activations.md). # PIM Role Activations ### Purpose The **PIM Role Activations** report provides visibility into how Privileged Identity Management (PIM) roles are being activated across your organization. The report helps security and IT teams understand who is activating privileged roles, why access is requested, how often elevated permissions are used, and whether activations follow organizational policies. By monitoring privileged role activations, organizations can detect unusual behavior, strengthen governance, and ensure administrative access is only used when needed. *** ### What can I use this report for? Use this report to: * Monitor privileged role activations * Identify frequently used administrative roles * Review justification and approval processes * Detect activations outside business hours * Investigate high-risk administrative activity * Support security audits and compliance reviews * Verify that privileged access follows the principle of least privilege *** ### Understanding Role Risk Roles are classified according to their potential impact on the tenant. | Risk Tier | Description | | --------- | -------------------------------------------------------------------- | | Critical | Roles with broad administrative control such as Global Administrator | | High | Roles with significant administrative privileges | | Medium | Roles with limited administrative scope | | Low | Roles with minimal security impact | Organizations should regularly review activations involving Critical and High-risk roles. *** ### Common Use Cases #### Review Critical Administrative Activity Filter on: * PIM Finding = Critical role elevation Review who activated privileged roles, why access was required, and whether approval was obtained. *** #### Identify After-Hours Administrative Activity Filter on: * PIM Finding = Outside business hours Investigate whether elevated access was expected and aligned with operational requirements. *** #### Review Currently Active Privileged Access Filter on: * PIM Finding = Active now Identify users who currently hold elevated permissions and verify access is still required. *** #### Analyze Role Usage Trends Break down by: * Role * Role category * Risk tier Identify which privileged roles are most frequently activated and where governance efforts should be focused. *** ### Recommended Actions Organizations should regularly review: * Critical role activations * Activations occurring outside business hours * Long-duration activations * Activations without approval requirements * Frequently activated administrative roles * Generic or unclear activation reasons Well-governed privileged access should be temporary, justified, approved when required, and limited to the minimum permissions necessary. *** ### Key Questions This Report Helps Answer * Which privileged roles are being activated most frequently? * Who is activating administrative access? * Why was elevated access requested? * Are approvals being used as expected? * Are privileged roles activated outside business hours? * Which users currently have active elevated permissions? * Are high-risk roles being used appropriately? *** ### Data Source This report uses data collected from: * Microsoft Entra ID * Microsoft Entra Privileged Identity Management (PIM) Data is updated during scheduled Bsure collection runs. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.bsure.io/user-guides/security/pim-role-activations.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.