[Entra ID] Privilege Elevation Request Denied

Original query, unchanged.

AuditLogs
| where ActivityDisplayName =~ 'Add member to role request denied (PIM activation)'
| mv-apply ResourceItem = TargetResources on
    (
    where ResourceItem.type =~ "Role"
    | extend Role = trim(@'"', tostring(ResourceItem.displayName))
    )
| mv-apply ResourceItem = TargetResources on
    (
    where ResourceItem.type =~ "User"
    | extend TargetUserPrincipalName = trim(@'"', tostring(ResourceItem.userPrincipalName))
    )
//| where ResultReason != "RoleAssignmentExists"
| where isnotempty(InitiatedBy.user)
| extend InitiatingAppName = tostring(InitiatedBy.app.displayName)
| extend InitiatingAppServicePrincipalId = tostring(InitiatedBy.app.servicePrincipalId)
| extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)
| extend InitiatingAadUserId = tostring(InitiatedBy.user.id)
| extend InitiatingIpAddress = tostring(iff(isnotempty(InitiatedBy.user.ipAddress), InitiatedBy.user.ipAddress, InitiatedBy.app.ipAddress))
| extend
    TargetName = tostring(split(TargetUserPrincipalName, '@', 0)[0]),
    TargetUPNSuffix = tostring(split(TargetUserPrincipalName, '@', 1)[0])
| extend
    InitiatedByName = tostring(split(InitiatingUserPrincipalName, '@', 0)[0]),
    InitiatedByUPNSuffix = tostring(split(InitiatingUserPrincipalName, '@', 1)[0])
| project-reorder
    TimeGenerated,
    TargetUserPrincipalName,
    Role,
    OperationName,
    Result,
    ResultDescription
| extend
    InitiatingUser = tostring(InitiatedBy.user.userPrincipalName)
| extend Source_Network_IPLocation = ""
| project
        Alert_Category_en = "Entra ID",
    Alert_SubCategory_en = "Anomaly Identity Privilege Modification",
    Alert_Name_en = "Privilege Elevation Request Denied",
    Alert_Description_en=strcat(
                         "At Taiwan time: ",
                         format_datetime(datetime_utc_to_local(TimeGenerated, "Asia/Taipei"), "yyyy-MM-dd HH:mm:ss"),
                         " in Entra ID:  ",
                         "",
                         ", detected PIM role activation failure: target user: ",
                         iff(isnotempty(TargetUserPrincipalName), TargetUserPrincipalName, "<NoTargetUser>"),
                         ", target role: ",
                         iff(isnotempty(Role), Role, "<NoRole>"),
                         ", initiator: ",
                         iff(isnotempty(InitiatingUser), InitiatingUser, "<NoInitiator>"),
                         ", source IP: ",
                         iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, "<NoIP>"),
                         ", result: ",
                         iff(isnotempty(Result), Result, "<NoResult>"),
                         " (reason: ",
                         iff(isnotempty(ResultDescription), ResultDescription, "<NoReason>"),
                         ")."
                     ),
    Alert_TriageStep_en=strcat(
                        "1. Confirm the activation target: user: ",
                        iff(isnotempty(TargetUserPrincipalName), TargetUserPrincipalName, "<NoTargetUser>"),
                        ", role: ",
                        iff(isnotempty(Role), Role, "<NoRole>"),
                        "  is an expected PIM activation request.",
                        "2. Check the failure reason: ",
                        iff(isnotempty(ResultDescription), ResultDescription, "<NoReason>"),
                        ", and determine whether it was caused by MFA/Conditional Access/approval process/insufficient permissions.",
                        "3. Check source risk: ",
                        iff(isnotempty(InitiatingUser), InitiatingUser, "<NoInitiator>"),
                        ", IP:",
                        iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, "<NoIP>"),
                        "  to determine whether it is a company named location/VPN/jump server, abnormal location, or uncommon source."
                    ),
    Alert_Containment_en=strcat(
                         "1. If determined to be a suspicious attempt, immediately restrict initiator: ",
                         iff(isnotempty(InitiatingUser), InitiatingUser, "<NoInitiator>"),
                         " 's PIM activation permissions or suspend the scope of high-risk roles that can be activated. ",
                         "2. Immediately revoke suspicious sign-in tokens/sessions and force re-authentication (initiator: ",
                         iff(isnotempty(InitiatingUser), InitiatingUser, "<NoInitiator>"),
                         "), and reset the password and re-register MFA if necessary.  ",
                         "3. Apply stricter Conditional Access to source IP: ",
                         iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, "<NoIP>"),
                         "  (named locations/compliant devices/MFA only), or block it first to stop repeated attempts.  ",
                         "4. If the failure was caused by the approval process/policy, suspend activation requests outside the change window and notify administrators for confirmation."
                     ),
    Alert_Remediation_en=strcat(
                         "1. Strengthen PIM governance: require approval and justification for high-privilege role activation, and limit the scope of activatable roles (least privilege/separation of duties).  ",
                         "2. Strengthen Conditional Access: enforce MFA, compliant devices, and named locations for PIM/management-plane operations, and directly block abnormal IPs/locations.  ",
                         "3. Establish alerts and automated response: set thresholds and automated SOAR for PIM activation failures (notification, IP blocking, account suspension).  "
                     ),
            Alert_Time_TW = datetime_utc_to_local(TimeGenerated, 'Asia/Taipei'),
    Alert_Time_UTC0 = TimeGenerated,
    Event_Action = OperationName,
    Event_Status = Result,
    Event_Description = ResultDescription,
    Source_Identity_FullName = InitiatingUser,
    Source_Identity_ID = InitiatingAadUserId,
    // Source_Identity_Name = InitiatingName,
    Source_Identity_Type = iff(isnotempty(InitiatingUser), "User", "Service"),
    Source_Network_IPAddress = InitiatingIpAddress,
    Target_Identity_FullName = TargetUserPrincipalName,
    Source_Resource_ID = InitiatingAppServicePrincipalId,
    Source_Resource_Name = InitiatingAppName,
    //Target_Identity_Name = InvitedUserName,
    Target_Identity_Type = "User",
    Target_Identity_DomainType = iff(TargetUserPrincipalName contains "EXT", 'External', 'Internal'),
    Target_Resource_ID = "",
    Target_Resource_Name = "Microsoft Entra ID",
    Target_Resource_Type = "Microsoft Entra ID"