diff --git a/Solutions/Microsoft Entra ID/Analytic Rules/NRT_PIMElevationRequestRejected.yaml b/Solutions/Microsoft Entra ID/Analytic Rules/NRT_PIMElevationRequestRejected.yaml
index 19d61305644..f0bbc9d2f6b 100644
--- a/Solutions/Microsoft Entra ID/Analytic Rules/NRT_PIMElevationRequestRejected.yaml	
+++ b/Solutions/Microsoft Entra ID/Analytic Rules/NRT_PIMElevationRequestRejected.yaml	
@@ -17,7 +17,7 @@ tags:
   - AADSecOpsGuide
 query: |
   AuditLogs
-  | ActivityDisplayName =~'Add member to role request denied (PIM activation)'
+  | where ActivityDisplayName =~ 'Add member to role request denied (PIM activation)'
   | mv-apply ResourceItem = TargetResources on 
     (
         where ResourceItem.type =~ "Role"