Merge pull request #11297 from LinkMJB/master

Added MS-PIM-Fairfax as a trusted identity for role modification, to support GCC-High / Azure Government
Azure · Oct 18, 2024 · 8910fde · 8910fde
2 parents 2c7c417 + 556d73b
commit 8910fde
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/Solutions/Microsoft Entra ID/Analytic Rules/PrivlegedRoleAssignedOutsidePIM.yaml b/Solutions/Microsoft Entra ID/Analytic Rules/PrivlegedRoleAssignedOutsidePIM.yaml
@@ -23,7 +23,7 @@ query: |
   AuditLogs
   | where Category =~ "RoleManagement"
   | where OperationName has "Add member to role outside of PIM"
-          or (LoggedByService =~ "Core Directory" and OperationName =~ "Add member to role" and Identity != "MS-PIM")
+          or (LoggedByService =~ "Core Directory" and OperationName =~ "Add member to role" and Identity != "MS-PIM" and Identity != "MS-PIM-Fairfax")
   | mv-apply TargetResource = TargetResources on 
     (
         where TargetResource.type =~ "User"
@@ -65,5 +65,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: InitiatingIpAddress
-version: 1.0.5
+version: 1.0.6
 kind: Scheduled