Role Assignments Made Outside PIM

The question it answers: Which directory roles were assigned directly instead of through Privileged Identity Management, and by whom?

Directory roles granted directly instead of through Privileged Identity Management: no approval, no justification, no expiry. In a tenant that uses PIM every row here is either a process gap or someone working around it.

Note

An entry counts when the activity is ‘Add member to role’ and it was not logged by the PIM service. Uses the audit data behind the Directory Changes report (up to 5,000 entries).

At a glance

Where in the app	Entra ID › Identity Hygiene › Role Assignments Outside PIM
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	None (about 7 days of audit history; 30 days with Microsoft Entra ID P1). PIM itself needs Microsoft Entra ID P2.
Report id (API and MCP)	entra.security.role-assignments-outside-pim

Columns

Column	Key	Type
When	Date	DateTime
Assigned to / role	DisplayName	Text
By	Secondary	Text
Result	Category	Status
All targets	Detail	Text
Logged by	Value	Text

What it needs

Licence: None (about 7 days of audit history; 30 days with Microsoft Entra ID P1). PIM itself needs Microsoft Entra ID P2.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
AuditLog.Read.All	Microsoft Graph	Read all audit log data

Data sources it reads

• GET /v1.0/auditLogs/directoryAudits

Through the API and MCP

GET /ir-api/v1/reports/entra.security.role-assignments-outside-pim?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.security.role-assignments-outside-pim. The client needs the Read grant for Entra ID. See Using the API.