How deeply does Azure Security cover Microsoft Entra Privileged Identity Management?

Defines active and eligible assignments and walks through Azure resource discovery, role settings, assignment, and activation.

Microsoft Entra Privileged Identity Management

As explained in Azure Security

Microsoft Entra Privileged Identity Management (PIM) is a capability for governing, activating, auditing, and limiting privileged access to resources and administrative roles.

Microsoft Entra Privileged Identity Management (PIM) limits standing privileged access while preserving administrators’ ability to perform necessary work. It supports least privilege by identifying privileged users, removing unneeded role access, and making users eligible to activate elevated access only when required. section 2.6.1 section 2.14

This reduces two operational risks: a user accidentally changing protected resources outside their duties, and a compromised identity causing greater damage through persistent administrative permissions. PIM also supports auditing of administrative roles, approval flows for privilege escalation, and alerts when administrative access is activated. section 2.6.1 section 2.6

PIM manages privileged assignments for:

Azure roles, including Azure RBAC roles for Azure resources. section 2.6.1
Azure AD roles used to administer Azure AD. section 2.6.1
Privileged access groups, assigned to users or groups. section 2.6.1

An assignment can be active or eligible, and can have a start and end time. An active assignment is already effective. An eligible assignment lets the user activate the role when a privileged task requires it, providing just-in-time administrative access rather than permanent access. section 2.6.1

To configure PIM for Azure roles, use this sequence:

Discover Azure resources: sign in to the Azure portal with a role such as Owner or User Access Administrator, open Azure AD Privileged Identity Management, select Azure Roles, discover subscriptions with write permission, then choose a subscription and manage the resource. section 2.6.2
Configure Azure role settings: open Azure Resources, select the protected subscription, choose Settings, select a role such as Virtual Machine Administrator Login, edit its settings, and update the configuration. section 2.6.2
Assign Azure roles, then activate assigned roles when privileged work is needed. section 2.6.2

Protecting a production subscription

A user who occasionally administers virtual machines need not retain permanent administrative access. Make the user eligible for the required Azure role, then have them activate it for the maintenance task. This helps limit accidental deletion of a production VM and narrows the impact if that identity is compromised. section 2.6.1

How Azure Security covers it

liveBook manning.com

Read Azure Security on liveBook Get the book at manning.com

Related concepts

Microsoft Entra IDuses · Microsoft Entra ID is Microsoft's cloud-based identity and access-management service for authenticating users, applications, and services and controlling their access to resources.
Azure roleuses · An Azure role is a defined set of permissions that controls what an identity can do to Azure resources.
just-in-time accessproduces · Just-in-time access is a privilege-management technique that grants elevated permissions only when needed, for a limited period or task, and then revokes them.
role-based access controlused by · Role-based access control is an authorization model that assigns permissions to roles and grants users or other principals access through their assigned roles.
principle of least privilegeaddresses · The principle of least privilege is a security principle that grants each user, process, or other subject only the access rights necessary for its authorized tasks.
identity governance and administrationused by · Identity governance and administration is the discipline of governing identity lifecycles, entitlements, access requests, approvals, and access reviews.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.