Alert on assignment and activation of highly privileged roles

Description

For every highly privileged role (list in CB-M365-ADMIN-006), the Privileged Identity Management notification settings send an email to {{ pim_alert_recipients }}, in addition to the default recipients, when:

• a member is assigned as eligible to the role;
• a member is assigned as active to the role;
• an eligible member activates the role (mandatory for Global Administrator).

The recipients are monitored mailboxes, or the alerts reach the SIEM by another path (audit log export, CB-M365-AUDIT-002).

The built-in PIM security alerts (for example roles assigned outside PIM) complement these notifications and can be reviewed in Privileged Identity Management > Alerts.

Rationale

New privileged assignments and activations are rare and meaningful events: an unexpected one is often the first visible step of a tenant takeover. The default PIM notifications go to the administrators themselves, who may be the compromised party; a monitored security mailbox gives an independent view.

Impact

The security mailbox receives an email per assignment and activation; volume depends on the number of administrators. Route it to a ticketing or SIEM rule rather than reading it by hand.

Applies when

Requires: Microsoft Entra ID P2

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to ID Governance > Privileged Identity Management > Microsoft Entra roles > Roles, open each highly privileged role > Role settings > Notification.
3. Check that Send notifications when members are assigned as eligible to this role, Send notifications when members are assigned as active to this role and Send notifications when eligible members activate this role, row Role assignment alert, list the addresses of {{ pim_alert_recipients }} under Additional recipients.
4. Read-only alternative with Microsoft Graph (scope RoleManagementPolicy.Read.Directory): expand the role's policy rules as in CB-M365-ADMIN-007 and read Notification_Admin_Admin_Eligibility, Notification_Admin_Admin_Assignment and Notification_Admin_EndUser_Assignment: notificationRecipients contains the addresses.
5. Fail if the parameter is empty, or if one of the three notifications of a highly privileged role does not reach a monitored address.

Remediation

1. With a Privileged Role Administrator, browse to ID Governance > Privileged Identity Management > Microsoft Entra roles > Roles, open each highly privileged role > Role settings > Edit > Notification.
2. For the three sections (eligible assignment, active assignment, activation), on the Role assignment alert row, add the monitored addresses under Additional recipients. Keep Default recipients checked.
3. Select Update. Activate a role with a test account and check that the email arrives.
4. Equivalent with Microsoft Graph: PATCH /policies/roleManagementPolicies/{policyId}/rules/Notification_Admin_EndUser_Assignment (and the two other rules) with the addresses in notificationRecipients.

Rollback

Remove the additional recipients from the notification settings.

References

• Email notifications in Privileged Identity Management Microsoft, vendor-doc, accessed 2026-10-24
• Configure Microsoft Entra role settings in Privileged Identity Management Microsoft, vendor-doc, accessed 2026-10-24
• Configure security alerts for Microsoft Entra roles in PIM Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-ADMIN-006 Grant highly privileged roles just in time through Privileged Identity Management
• related CB-M365-AUDIT-002 Forward Microsoft 365 security logs to the SIEM or SOC

People and lifecycle