diff --git a/Solutions/Azure Active Directory/Analytic Rules/PIMElevationRequestRejected.yaml b/Solutions/Azure Active Directory/Analytic Rules/PIMElevationRequestRejected.yaml
index a3f611e59d0..81123db02a5 100644
--- a/Solutions/Azure Active Directory/Analytic Rules/PIMElevationRequestRejected.yaml	
+++ b/Solutions/Azure Active Directory/Analytic Rules/PIMElevationRequestRejected.yaml	
@@ -21,7 +21,7 @@ tags:
   - AADSecOpsGuide
 query: |
   AuditLogs
-  | ActivityDisplayName =~'Add member to role request denied (PIM activation)'
+  | where ActivityDisplayName =~'Add member to role request denied (PIM activation)'
   | mv-apply ResourceItem = TargetResources on 
     (
         where ResourceItem.type =~ "Role"