SOLVED

PIM Role Alerts

%3CLINGO-SUB%20id%3D%22lingo-sub-1100601%22%20slang%3D%22en-US%22%3EPIM%20Role%20Alerts%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1100601%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Team%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENeed%20help%20for%20querying%20PIM%20role%20assigned%20to%20any%20resource%20group%20or%20any%20changes%20made%20and%20creating%20alert%20of%20it.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERegards%2C%3C%2FP%3E%3CP%3ERahul%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1100601%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1104572%22%20slang%3D%22en-US%22%3ERe%3A%20PIM%20Role%20Alerts%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1104572%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F380509%22%20target%3D%22_blank%22%3E%40Rahul_Mahajan%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20don't%20recall%20PIM%20having%20the%20option%20to%20store%20its%20logs%20in%20Log%20Analytics.%26nbsp%3B%20You%20can%20see%20details%20on%20what%20is%20happening%20in%20a%20Resource%20Group%20in%20the%20%3CSTRONG%3EActivity%20Log%3C%2FSTRONG%3E%20if%20that%20what%20you%20mean%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1108320%22%20slang%3D%22en-US%22%3ERe%3A%20PIM%20Role%20Alerts%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1108320%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F380509%22%20target%3D%22_blank%22%3E%40Rahul_Mahajan%3C%2FA%3E%26nbsp%3BPIM%20logs%20are%20automatically%20integrated%20into%20the%20existing%20AuditLogs.%26nbsp%3B%20If%20you%20use%3A%3C%2FP%3E%3CP%3EAuditLogs%3C%2FP%3E%3CP%3E%7C%20search%20%22PIM%22%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20should%20be%20able%20to%20find%20which%20events%20are%20associated%20with%20PIM%20and%20customize%20your%20alerts%20accordingly.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1114229%22%20slang%3D%22en-US%22%3ERe%3A%20PIM%20Role%20Alerts%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1114229%22%20slang%3D%22en-US%22%3EThanks%20a%20lot%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F418279%22%20target%3D%22_blank%22%3E%40leoszalkowski%3C%2FA%3E%20%3A)%3C%2Fimg%3E%3C%2FLINGO-BODY%3E
Contributor

Hi Team,

 

Need help for querying PIM role assigned to any resource group or any changes made and creating alert of it.

 

Regards,

Rahul

3 Replies

@Rahul_Mahajan 

 

I don't recall PIM having the option to store its logs in Log Analytics.  You can see details on what is happening in a Resource Group in the Activity Log if that what you mean?

Best Response confirmed by Rahul_Mahajan (Contributor)
Solution

@Rahul_Mahajan PIM logs are automatically integrated into the existing AuditLogs.  If you use:

AuditLogs

| search "PIM" 

 

You should be able to find which events are associated with PIM and customize your alerts accordingly.

Thanks a lot @leoszalkowski :)