Azure AD PIM alert disabled

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: AzureAD Audit Log
Detection Modules	Identity Threat Module
ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Domain Policy Modification (T1484)
Severity	Medium

An identity disabled an Azure AD PIM alert.

An attacker might want to disable alerts associated with authentication requirements for privileged access.
This may allow malicious activities to go unnoticed.

Check what alert was disabled.
Check whether the user that disabled the alert is permitted to perform such actions.