Investigate what interface was used to perform the activation, and lock it down so it doesn't serve in the future as an attack ...

Investigate what interface was used to perform the activation, and lock it down so it doesn't serve in the future as an attack vector. Migrate all privileged roles to Azure AD PIM. Configure all privileged role activations with a strict time window which is just enough to perform their job, not more.