Way to get PIM notifications to event hub

Hi @Abed Elheyb ,

Thanks for reaching out to Microsoft Q&A.

To send real-time PIM notifications to Azure Event Hub, you can leverage Microsoft Entra ID diagnostic settings and stream PIM audit logs directly to Event Hub. This allows you to trigger a Function App using an Event Hub trigger whenever a PIM event occurs.

Steps to configure PIM events to Event Hub:

• Navigate to Microsoft Entra ID in the Azure portal.
• Select Diagnostic settings and click + Add diagnostic setting.
• Select AuditLogs (which contains PIM activity).
• Check Stream to an event hub.
• Select the Event Hub namespace, policy, and specific Event Hub.

Triggering a Function App:

Once configured, every PIM-related audit event is streamed to Event Hub in near real time. You can then:

• Create an Azure Function App
• Use an Event Hub trigger
• Process PIM events programmatically (alerts, automation, integrations, etc.)

Sample Azure Function code that triggers when a message is received from Event Hub and filters PIM-specific events.

public class Function1
{
    private readonly ILogger<Function1> _logger;
    public Function1(ILogger<Function1> logger)
    {
        _logger = logger;
    }
    [Function(nameof(Function1))]
    public void Run(
        [EventHubTrigger(
            "samples-workitems",
            Connection = "EventHubConnection")]
        EventData[] events)
    {
        foreach (EventData eventData in events)
        {
            try
            {
                var messageBody = Encoding.UTF8.GetString(eventData.Body.ToArray());
                _logger.LogInformation("Raw Event Hub Message: {message}", messageBody);
                var json = JObject.Parse(messageBody);
                var records = json["records"];
                if (records == null)
                    continue;
                foreach (var record in records)
                {
                    if (record["loggedByService"]?.ToString() == "PIM")
                    {
                        var activity = record["activityDisplayName"]?.ToString();
                        var operation = record["operationName"]?.ToString();
                        var user = record["initiatedBy"]?["user"]?["userPrincipalName"]?.ToString();
                        var role = record["targetResources"]?[0]?["displayName"]?.ToString();
                        _logger.LogInformation("PIM Event Detected");
                        _logger.LogInformation("User: {user}", user);
                        _logger.LogInformation("Role: {role}", role);
                        _logger.LogInformation("Activity: {activity}", activity);
                        _logger.LogInformation("Operation: {operation}", operation);
                    }
                }
            }
            catch (Exception ex)
            {
                _logger.LogError(ex, "Error processing Event Hub message");
            }
        }
    }
}

Hope this helps!

If the resolution was helpful, kindly take a moment to click on and click on Yes for was this answer helpful. And, if you have any further query do let us know.