Entra ID Monitoring Plan Capture Privilege Escalation

Auditor Auditor Ideas
, ,
1

What is a one sentence summary of your feature request?

Audit logs from entra should log privilege escalation in the entra id monitoring plan

Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.

Tracking outside vendors accessing our environment we need to see what they are doing and when.

How do you currently solve the challenges you have by not having this feature?

Downloading audit logs in the azure portal

2

Hi Matthew Sailor, thanks for the idea. To make sure we capture the right thing, could you clarify a few points?

  1. By “privilege escalation”, do you mean
    (a) vendors activating eligible roles through PIM,
    (b) any role assignment changes (permanent or eligible, including via groups),
    (c) both?
  2. How do you identify “outside vendors”: guest (B2B) accounts, a specific group, or partner/GDAP relationships?
  3. Do you use Entra ID P2 / PIM in your tenant?
  4. Which specific events do you currently look for in the portal audit logs? An example of a filter or an event name would help a lot.

Thanks, this will help us scope the request properly.
Evgenii