# Activation alert for all privileged role assignments
Without activation alerts for privileged role assignments, threat actors can escalate privileges undetected.
Source: https://maester.dev/docs/tests/ZTA.21820
:::note[Maester checks this too]
[CISA.MS.AAD.7.9](/docs/tests/CISA.MS.AAD.7.9) (User activation of other highly privileged roles SHOULD trigger an alert.) checks the same setting. Running both reports it twice.
:::
## Overview
Without activation alerts for privileged role assignments, threat actors can escalate privileges undetected. This lack of visibility creates a blind spot where attackers can activate the most privileged role and perform malicious actions such as creating backdoor accounts, modifying security policies, or accessing sensitive data.
Monitoring these activation alerts can help security teams distinguish between authorized and unauthorized privilege escalation activities.
## Remediation
- [Configure notifications for privileged roles](https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-how-to-change-default-settings?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#require-justification-on-active-assignment)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Low |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | Identity |
| Category | Privileged access |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Privileged Identity Management |
| Area | Privileged access |
| ATT&CK | [T1098.003](/docs/tests?mitre=T1098.003) Additional Cloud Roles, [T1548.005](/docs/tests?mitre=T1548.005) Temporary Elevated Cloud Access |
| Licence | P2 |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.