How to find PIM role activations in Microsoft Entra ID

Before you start

Use an account in the Global Reader, Security Reader or Security Administrator role, which can read both the audit log and PIM's own history; Reports Reader can read the audit log too. The PowerShell example requests AuditLog.Read.All; your organisation may require administrator consent.

Know what is logged. 1 activation writes several entries: the request, the approval where the role needs one, and the completion, when the role was actually added. This guide reads the completion. Activations of groups and of Azure resource roles are logged under other categories. The examples read and export; they don't activate, approve or remove any role.

Option 1

Find PIM role activations with PowerShell

Install the modules once, then connect and export the completed activations of the last 30 days. The date and activity filter runs in Microsoft Graph, so only those entries come back.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Reports -Scope CurrentUser

$ErrorActionPreference = 'Stop'
$days = 30
$since = (Get-Date).ToUniversalTime().AddDays(-$days).ToString('yyyy-MM-ddTHH:mm:ssZ')
$activity = 'Add member to role completed (PIM activation)'
Connect-MgGraph -Scopes 'AuditLog.Read.All' -NoWelcome
try {
    $filter = "activityDateTime ge $since and activityDisplayName eq '$activity'"
    $entries = @(Get-MgAuditLogDirectoryAudit -All -Filter $filter)
    $entries = @($entries | Where-Object { $_.Category -eq 'RoleManagement' })
    $report = @($entries | Sort-Object ActivityDateTime -Descending | ForEach-Object {
        [pscustomobject]@{
            When    = $_.ActivityDateTime
            Person  = $_.InitiatedBy.User.UserPrincipalName
            Targets = @($_.TargetResources.DisplayName | Where-Object { $_ }) -join '; '
            Reason  = $_.ResultReason
            Result  = $_.Result
        }
    })
    if ($report.Count -eq 0) {
        Write-Output "No PIM role activation completed in the last $days days."
    } else {
        $report | Export-Csv -Path './pim-role-activations.csv' -NoTypeInformation -Encoding utf8
        $people = @($report.Person | Sort-Object -Unique).Count
        Write-Output "$($report.Count) role activations by $people people in $days days."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

Person is the account that activated the role, Targets names what the entry records, the role among them, and Reason is the status reason PIM logged. Where a role needs approval, the approver shows on a separate entry, Add member to role request approved (PIM activation). Times are in UTC. To keep more than 30 days, run the script on a schedule and keep each CSV.

Option 2

Review PIM activations in the admin centre

1. Sign in to the Microsoft Entra admin centre as at least a Security Reader.
2. Go to ID Governance > Privileged Identity Management > Microsoft Entra roles.
3. Select Resource audit, then filter the history to a predefined date or a custom range.
4. Read the entries for role activations. For the full entry, go to Entra ID > Monitoring & health > Audit logs and use the Service filter to show only Privileged Identity Management.
5. Leave without changing any assignment or setting.

This suits a quick look at who activated what this week. The history covers 30 days and isn't kept beyond that, so for a record you can keep, use PowerShell or a report.

Common questions

How do I keep activations for longer than 30 days?

Send the Entra audit logs through diagnostic settings in Azure Monitor to an Azure storage account or a Log Analytics workspace. Otherwise, export them before the days fall out of the log.

Where are the activations of groups and Azure roles?

They use the same activity names under the GroupManagement and ResourceManagement categories. To include them, remove the line of the script that keeps only RoleManagement. For Azure roles, PIM also has a Resource audit for each resource under Azure resources.

Who can activate a role in the first place?

Anyone with an eligible assignment to it, directly or through a group. To list them with the active and permanent assignments, see how to list admin role assignments.