Privileged Account Audit
The prompt
In Microsoft Entra ID, list all users currently assigned to the following roles: Global Administrator, Security Administrator, and Privileged Role Administrator. For each user: 1. Display name and UPN 2. Account type (member or guest) 3. MFA status (registered, not registered, or enforced by conditional access) 4. Last sign-in date 5. Whether the role is permanent or time-limited (PIM-eligible) Return as a table. Flag any guest accounts with privileged roles, any accounts with no MFA, and any accounts with no sign-in in the last 90 days.
How to use it
- 1Select Copy the prompt above.
- 2Paste it into Microsoft 365 Copilot.
- 3Replace anything in brackets with your own detail, then send it.
Copilot gathers and drafts. You verify and decide. Check every figure, name and date against the system it came from before you act on it.
Written for
Identity Security Analyst, SOC Analyst L2
More for Microsoft Copilot for Security
- First Look — Incident Summary
- Alert Triage — Is This a True Positive?
- Multi-Alert Correlation — Single Incident Thread
- Device Investigation — Rapid Scope
From the source collection in awesome-microsoft-copilot-prompts, licensed CC BY-SA 4.0.