Add Eligible Member To Role In Pim Completed

Azure

Add Eligible Member To Role In Pim Completed

service: Azure - Microsoft Entra ID

tactics:

Privilege Escalation Persistence

techniques:

T1098.003

tags:

Azure Microsoft Entra ID

Event

Adds a user as an eligible member for a privileged role in Azure PIM, allowing them to activate the role on demand.

Security Context

• Account manipulation is a primary persistence technique, allowing adversaries to maintain access through modified permissions or credentials.

Log Source

Entra ID Audit Logs

Sample Event

Adversarial. Compromised user draco@fantasticlogs.cloud (already a Privileged Role Administrator following the elevateAccess chain) creates a permanent PIM eligible assignment of the Global Administrator role on his own account. This sets up an unprivileged baseline (no role active, low signal) plus the ability to JIT-activate Global Admin whenever needed — a stealthier persistence pattern than holding the role active. loggedByService is PIM, category is RoleManagement, operationType is Add. targetResources reflect both the user receiving the eligibility and the role template being made eligible.

{
  "id": "Directory_90000000-0000-4000-8000-000001100101_2B7E5_60718244",
  "category": "RoleManagement",
  "correlationId": "90000000-0000-4000-8000-000001100101",
  "result": "success",
  "resultReason": "",
  "activityDisplayName": "Add eligible member to role in PIM completed (permanent)",
  "activityDateTime": "2026-04-15T18:21:33.0884712Z",
  "loggedByService": "PIM",
  "operationType": "Add",
  "initiatedBy": {
    "app": null,
    "user": {
      "id": "30000000-0000-4000-8000-001010011010",
      "displayName": "Draco Malfoy",
      "userPrincipalName": "draco@fantasticlogs.cloud",
      "ipAddress": "203.0.113.66"
    }
  },
  "targetResources": [
    {
      "id": "30000000-0000-4000-8000-001010011010",
      "displayName": "Draco Malfoy",
      "type": "User",
      "userPrincipalName": "draco@fantasticlogs.cloud",
      "groupType": null,
      "modifiedProperties": [
        {
          "displayName": "Role.DisplayName",
          "oldValue": "[]",
          "newValue": "[\"Global Administrator\"]"
        },
        {
          "displayName": "Role.TemplateId",
          "oldValue": "[]",
          "newValue": "[\"62e90394-69f5-4237-9190-012177145e10\"]"
        },
        {
          "displayName": "Role.ObjectId",
          "oldValue": "[]",
          "newValue": "[\"50000000-0000-4000-8000-000000000001\"]"
        },
        {
          "displayName": "Member.Type",
          "oldValue": "[]",
          "newValue": "[\"User\"]"
        },
        {
          "displayName": "Assignment.Scope",
          "oldValue": "[]",
          "newValue": "[\"/\"]"
        },
        {
          "displayName": "Assignment.Type",
          "oldValue": "[]",
          "newValue": "[\"Eligible\"]"
        },
        {
          "displayName": "Assignment.AssignmentState",
          "oldValue": "[]",
          "newValue": "[\"Eligible\"]"
        },
        {
          "displayName": "Assignment.IsPermanent",
          "oldValue": "[]",
          "newValue": "[true]"
        },
        {
          "displayName": "Included Updated Properties",
          "oldValue": null,
          "newValue": "\"Role.DisplayName, Role.TemplateId, Role.ObjectId, Member.Type, Assignment.Scope, Assignment.Type, Assignment.AssignmentState, Assignment.IsPermanent\""
        }
      ]
    },
    {
      "id": "62e90394-69f5-4237-9190-012177145e10",
      "displayName": "Global Administrator",
      "type": "Role",
      "userPrincipalName": null,
      "groupType": null,
      "modifiedProperties": []
    }
  ],
  "additionalDetails": [
    {
      "key": "RequestType",
      "value": "AdminAdd"
    },
    {
      "key": "User-Agent",
      "value": "python/3.11.6 (Linux-5.15.0-1052-aws-x86_64-with-glibc2.35) AZURECLI/2.56.0 (DEB)"
    }
  ]
}

MITRE ATT&CK Mapping

Tactics: Privilege Escalation Persistence

Techniques:

• T1098.003 — Additional Cloud Roles — An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments. With sufficient permi...

Related Events

shares T1098.003 — Additional Cloud Roles

Add App Role Assignment To Service Principal Add Member To Role Add Role Definition add-iam-policy-binding CreateRole CreateServiceLinkedRole Microsoft.Authorization/roleAssignments/write Microsoft.Directory/groups/members/update +2 more

same service (Azure - Microsoft Entra ID)

Add Application Add Federated Identity Credential Add Owner To Application Add Owner To Group Add Service Principal Add User Add Verified Domain Admin Registered Security Info +7 more