ACSC Logo
© GEMXIT
GEMXIT Logo
Agent Foskett Investigation • Privilege Escalation • Microsoft Entra PIM • Global Administrator • AuditLogs • KQL

The Global Administrator Role Was Active for Only 17 Minutes

The security team checked the account.

It was not a Global Administrator.

No permanent privileged assignment appeared. Nothing obvious explained the administrative changes that had occurred overnight.

Then Agent Foskett stopped asking what access the user had now.

For seventeen minutes, the account had held one of the most powerful roles in the tenant.

Discuss identity security Back to investigations
Agent Foskett investigating a short-lived Global Administrator role activation in Microsoft Entra Privileged Identity Management
Privilege Escalation Investigation

The role was gone when investigators looked. The evidence was not.

Investigate historical privilege, not only current roles
Review Entra role-management and PIM activity
Correlate privilege with actions performed during the window

The account looked unprivileged

A point-in-time role check answered the wrong question. The investigation needed to establish what privileges the identity held during the incident—not what remained assigned hours later.
No permanent Global Administrator roleThe user did not appear privileged when the account was reviewed after the incident.
Seventeen-minute activationThe audit trail showed a temporary privileged window that had already ended.
The timing matteredAdministrative activity occurred while the elevated role was active, turning a role event into an incident timeline.

The privilege window

Agent Foskett rebuilt the sequence before deciding what it meant. The short duration was not reassuring—it was the clue.
investigation-timeline.txt
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
02:03  Suspicious sign-in
02:14  New MFA method registered
02:31  Global Administrator activated
02:36  Administrative change recorded
02:43  Second privileged action recorded
02:48  Global Administrator activation ended

Privileged window:
17 minutes

Start with role-management activity

Where Microsoft Entra audit logs are available in Sentinel or Log Analytics, begin broadly. Activity names can vary, so inspect the RoleManagement category before filtering for one exact PIM event.
role-management-activity.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
AuditLogs
| where TimeGenerated > ago(7d)
| where Category =~ "RoleManagement"
| project TimeGenerated,
          ActivityDisplayName,
          Result,
          InitiatedBy,
          TargetResources,
          AdditionalDetails
| order by TimeGenerated asc

Discover the PIM activity names in your tenant

Do not assume every environment records the exact same display string. First discover which role-management activities are present, then narrow the hunt around activation, assignment and removal events.
discover-role-events.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
AuditLogs
| where TimeGenerated > ago(30d)
| where Category =~ "RoleManagement"
| summarize Events = count()
    by ActivityDisplayName, Result
| order by Events desc

Search for temporary privilege around the user

After discovering the available activity names, focus on events associated with the account and examine the target-resource details for role names, assignment state and activation context.
hunt-user-role-events.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
AuditLogs
| where TimeGenerated between (datetime(2026-08-15 02:00:00) .. datetime(2026-08-15 03:00:00))
| where Category =~ "RoleManagement"
| where tostring(TargetResources) has "alex.morgan@contoso.com"
   or tostring(InitiatedBy) has "alex.morgan@contoso.com"
| project TimeGenerated,
          ActivityDisplayName,
          Result,
          TargetResources,
          InitiatedBy
| order by TimeGenerated asc

Do not stop when you find the activation

The role event proves elevation occurred. The investigation still has to establish what the identity did while elevated. Search the same time window for directory, application, policy and account changes available in your telemetry.
privileged-window-audit.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
AuditLogs
| where TimeGenerated between (datetime(2026-08-15 02:31:00) .. datetime(2026-08-15 02:48:00))
| where tostring(InitiatedBy) has "alex.morgan@contoso.com"
| project TimeGenerated,
          Category,
          ActivityDisplayName,
          Result,
          TargetResources
| order by TimeGenerated asc

Correlate the privilege with the sign-in

If SigninLogs are available alongside the audit data, compare the privileged window with the session that preceded it. The objective is not merely to find two events—it is to determine whether they form one coherent attack sequence.
identity-privilege-timeline.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
SigninLogs
| where TimeGenerated between (datetime(2026-08-15 02:00:00) .. datetime(2026-08-15 03:00:00))
| where UserPrincipalName =~ "alex.morgan@contoso.com"
| project TimeGenerated,
          UserPrincipalName,
          IPAddress,
          AppDisplayName,
          ConditionalAccessStatus,
          ResultType,
          CorrelationId
| order by TimeGenerated asc

Current privilege is not historical privilege

Temporary elevation changes how investigators should interpret a later role check. An identity can be non-privileged now and still have performed highly privileged actions earlier.
Do not rely on the current role listIt shows present state. It does not reconstruct what the user could do during the incident window.
Follow the activation historyPIM and role-management telemetry can reveal privilege that existed only briefly.
Investigate the window itselfEvery directory or policy change made during temporary elevation deserves context and attribution.

Agent Foskett's investigation mindset

Privilege is not only a property of an account. It is something that can appear, disappear and change the meaning of every action inside a narrow period of time.
Ask what access existed thenHistorical state matters more than current state when reconstructing an incident.
Treat short duration as evidenceA seventeen-minute activation can be enough to create accounts, alter policies or establish persistence.
Correlate before concludingRole activation by itself may be legitimate. Timing, initiator, reason, authentication context and subsequent actions determine the story.

Investigation findings

The user was not permanently privileged. That fact was true—and still almost caused the investigation to miss the most important seventeen minutes.
The role check was accurateThe account was not a Global Administrator when investigators examined it.
The audit trail changed the answerHistorical role-management activity revealed the temporary elevation.
The seventeen minutes became the focusActions performed during the privileged window were more important than the account's later role state.

Related Agent Foskett investigations

Continue with identity compromise, MFA persistence, privileged identities and Conditional Access investigations.
The New MFA Method Was Registered 11 Minutes After the LoginCorrelate a successful sign-in with a security-information change that followed minutes later.
The MFA Method Was Added At 3:14AMInvestigate suspicious authentication-method registration and identity persistence.
The Service Principal Had Global AdministratorInvestigate privileged application identities and excessive directory permissions.
The User Was Added To A Privileged Group At 3:12AMFollow an unexpected privilege change back through the identity timeline.
The Conditional Access Policy Existed — But It Wasn't Protecting AnythingInvestigate the difference between having a policy and actually enforcing protection.
Agent Foskett AcademyBuild practical KQL and Microsoft security investigation skills through structured lessons.
The role was gone. The seventeen minutes were not.
Reconstruct historical privilege, inspect the actions and follow the identity timeline.
Visit the Agent Foskett Academy

Final thought

A security investigation can be completely accurate about what an account is allowed to do now and completely wrong about what it was able to do when the incident happened.
Present state is only one snapshotPrivilege must be reconstructed across time, not inferred from a later role list.
Temporary does not mean harmlessA short activation can provide enough access to make changes with long-lasting consequences.
Investigate the privilege windowThe role activation matters because of what happened while it existed.
Develop IT. Protect IT.
GEMXIT PTY LTD | GEMXIT UK LTD
Talk to GEMXIT
ACSC Logo

GEMXIT PTY LTD  |  GEMXIT UK LTD  |  © GEMXIT

The Global Administrator Role Was Active for Only 17 Minutes

This Agent Foskett investigation explores how temporary Microsoft Entra privileged-role activation can disappear before an analyst checks the account, leaving historical audit evidence as the key to reconstructing what access existed during an incident.

Microsoft Entra PIM And Global Administrator Investigation

The page demonstrates how investigators can review Entra role-management audit activity, discover PIM-related events, identify short-lived privilege elevation and correlate the activation with administrative actions performed during the privileged window.

KQL, AuditLogs And Privilege Escalation Investigation

GEMXIT helps organisations investigate Microsoft Entra privileged identities, PIM activity, Global Administrator exposure, identity compromise and cloud security telemetry using practical KQL and evidence-driven investigation workflows.