# Privileged role activations have monitoring and alerting configured
Organizations without proper activation alerts for highly privileged roles lack visibility into when users access these critical permissions.
Source: https://maester.dev/docs/tests/ZTA.21818
## Overview
Organizations without proper activation alerts for highly privileged roles lack visibility into when users access these critical permissions. Threat actors can exploit this monitoring gap to perform privilege escalation by activating highly privileged roles without detection, then establish persistence through admin account creation or security policy modifications. The absence of real-time alerts enables attackers to conduct lateral movement, modify audit configurations, and disable security controls without triggering immediate response procedures.
## Remediation
- [Configure Microsoft Entra role settings in Privileged Identity Management](https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-how-to-change-default-settings?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#require-justification-on-activation)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | Identity |
| Category | Monitoring |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Privileged Identity Management |
| Area | Privileged access |
| ATT&CK | [T1098.003](/docs/tests?mitre=T1098.003) Additional Cloud Roles, [T1548.005](/docs/tests?mitre=T1548.005) Temporary Elevated Cloud Access |
| Licence | AAD_PREMIUM_P2, Entra_Identity_Governance |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.