2.1.3.2. Design for Microsoft Entra Privileged Identity Management (PIM)
2.1.3.2. Design for Microsoft Entra Privileged Identity Management (PIM)
💡 First Principle: Reducing the risk of excessive or misused permissions is achieved by providing privileged access only when needed (Just-In-Time) and with only the necessary permissions (Just-Enough-Access), enforced through time-bound activation and approval workflows.
Scenario: Your organization has a small number of administrators with "Owner" access to production subscriptions. This high-level access is a security risk if compromised. You need to implement a solution that grants these administrators "Owner" permissions only when they explicitly request it, for a limited time, and potentially with an approval workflow.
Microsoft Entra PIM is a service within Microsoft Entra ID that helps you manage, control, and monitor access to important resources in Microsoft Entra ID, Azure, and other Microsoft online services.
Core Principles:
- Just-In-Time (JIT) Access: Grants temporary privileged access for a defined period (e.g., 4 hours), automatically revoking it afterward to minimize risk exposure. Users activate the role only when needed.
- Just-Enough-Access (JEA): Restricts permissions to only what is necessary for the specific task, preventing over-privileging and enforcing least privilege.
Key Features:
- Role Activation: Users must activate eligible roles when needed, ensuring access is intentional and time-bound. Activation can require MFA or a business justification.
- Approval Workflows: Role activation can require approval from designated approvers, adding oversight and control to privileged access requests.
- Access Reviews: Regular reviews prompt verification that privileged access is still required, supporting compliance and reducing standing permissions.
- Auditing and Alerts: All privileged activities (role activations, assignments) are logged, and alerts can be triggered for suspicious actions, enabling rapid response to potential misuse.
⚠️ Common Pitfall: Making users eligible for highly privileged roles without configuring mandatory MFA, justification, or approval for activation. This reduces the effectiveness of PIM as a security control.
Key Trade-Offs:
- Security vs. Administrative Friction: PIM introduces an extra step (activation) for administrators. This slight friction is a deliberate trade-off for a significant increase in security by eliminating standing privileged access.
Beyond PIM: designing identity governance with Microsoft Entra ID Governance
PIM governs privileged access. The outline's "Recommend a solution for identity governance" is broader: who gets access at all, how long they keep it, and what happens when they join, move or leave. Microsoft Entra ID Governance brings four capabilities together:
| Capability | Question it answers | Typical exam signal |
|---|---|---|
| Privileged Identity Management | Should this admin role be active right now? | Just-in-time activation, approval, time-bound roles |
| Access reviews | Does this person still need this access? | "Recertify quarterly", "remove guests who no longer need access" |
| Entitlement management | How does someone request a bundle of access, and when does it end? | Access packages, partner onboarding, approval, expiration |
| Lifecycle workflows | What must happen automatically when someone joins, moves or leaves? | HR hire and leave dates, Temporary Access Pass, disable on the last day |
Where each review is created is a common distractor. Reviews of group members and app assignments are created in Access reviews; reviews of Microsoft Entra roles and Azure resource roles are created in PIM; reviews of access package assignments are created in entitlement management.
Entitlement management details worth knowing:
- An access package bundles group and Teams membership, enterprise application assignments and SharePoint Online sites. Its policies decide who can request it, who approves, and when the assignment expires.
- A connected organization lets people from a partner directory request access before they exist in yours. Approved requesters are invited automatically, and when their last assignment expires their B2B account can be removed.
- Separation of duties: mark another access package, or a group, as incompatible. The check is one-directional, so to make two packages mutually exclusive you configure it on both.
Licensing (check it before you recommend a feature). Per Microsoft Entra ID Governance licensing fundamentals:
| Capability | Microsoft Entra ID P2 | Microsoft Entra ID Governance |
|---|---|---|
| PIM, including PIM for Groups | Yes | Yes |
| Core access reviews (groups, apps, roles) | Yes | Yes |
| Access packages with request, approval and expiration | Yes | Yes |
| Lifecycle workflows | No | Yes |
| Entitlement management auto-assignment policies | No | Yes |
| Machine-learning-assisted review recommendations | No | Yes |
Microsoft Entra ID Governance requires Microsoft Entra ID P1 or P2 in the tenant (there is a Step Up product for P2 tenants), and Microsoft Entra Suite includes the same governance capabilities. Microsoft states that no new identity governance features will be added to P2. Governing guest users is billed per monthly active user and needs an Azure subscription linked for guest billing.
⚠️ Exam Trap: "the tenant already has P2" does not cover lifecycle workflows. Joiner and leaver automation driven by hire and leave dates is a Microsoft Entra ID Governance feature.
Reflection Question: How does designing for Microsoft Entra Privileged Identity Management (PIM), by enforcing Just-In-Time (JIT) and Just-Enough-Access (JEA) principles, fundamentally reduce the risk of excessive, unnecessary, or misused permissions for privileged accounts in Azure?
