liveBook · Manning

Active assignment

As explained in Azure Security

An active assignment is a role assignment whose permissions are immediately available to the assigned identity for its configured duration.

An active assignment makes a role’s permissions immediately available to the assigned identity or group. In Privileged Identity Management (PIM), it contrasts with an eligible assignment, which requires activation before privileged work. section 2.6.1 section 2.6.2

Active assignments support several configuration decisions:

  • Assign an Azure RBAC role, Azure AD role, or privileged access group to a user or group. section 2.6.1
  • Configure the assignment with a start and end time, or use an active assignment for ongoing access. section 2.6.1 section 2.6.2
  • Prefer eligible access when privileged permissions should require an action such as MFA or approval before use. section 2.6.2

Assigning a role in PIM

Open Azure AD Privileged Identity Management, choose Azure Resources, select a subscription and Roles, and choose Add Assignments. Select a role such as Virtual Machine Administrator Login and a member such as Bob or a group. Under Assignment Type, choose Active, set Assignment Starts and Assignment Ends, and select Assign. section 2.6.2

How Azure Security covers it

How deep it goes
Defines active and eligible assignments and identifies timing controls, but defers detailed activation behavior to eligible access.
Examples
Uses Virtual Machine Administrator Login assigned to Bob or a group as the concrete role-assignment example.
What it assumes
Assumes an Azure subscription, an available Azure role, and an identity or group to receive the assignment.
What you can do after
Configure Azure role assignments in PIM by selecting Active or Eligible and setting assignment timing.
How it connects
Connects Azure RBAC roles, Azure AD roles, privileged access groups, identities, permissions, and privileged identity management.
Cover of Azure Security
liveBookmanning.com
Read Azure Security on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.