Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community

PIM Builtin Alerts in Audit Log

Copper Contributor

Hello,

 

We would like create an Sentinel alert rule for the builtin alert in PIM: "Roles are being assigned outside of Privileged Identity Management" Are these builtin alerts traceble in the AD Audit Logs?

 

Regards, Erik

1 Reply

@Erik_Snijder I think you just might need to use the MCAS Alerts for this, and integrate MCAS to Sentinel