2.3 Microsoft Entra Privileged Identity Management (PIM)

2.3 Microsoft Entra Privileged Identity Management (PIM)

Privileged accounts represent the highest-value targets for cyber attackers. Holding permanent, standing administrative privileges (such as Global Administrator or Subscription Owner) creates severe risk: if an administrator falls victim to phishing or malware, attackers immediately gain unchecked control over cloud infrastructure. Microsoft Entra Privileged Identity Management (PIM) mitigates this risk by enforcing the Just-In-Time (JIT) access model and Zero Standing Privileges (ZSP).

---

PIM Architecture & The Just-In-Time Model

Under traditional access management, users hold permanent active permissions. Under PIM's Just-In-Time model, users have zero standing permissions. Instead, administrators are granted eligibility for privileged roles.

[ Standing State: Zero Privileges ]
               |
               v
[ User Initiates PIM Activation Request ]
               |
               v
[ Gate Checks: MFA + Business Justification + Ticket ID + Approval ]
               |
               v
[ Temporary Role Activation (e.g., 4-Hour Window) ]
               |
               v
[ Expiration Timer Triggered -> Automatic Revocation to Zero Privileges ]

Key Concepts

• Eligible Assignment: The user is qualified to use the role, but does not possess active permissions continuously. To use the role, the user must initiate a time-bound activation request in PIM.
• Active Assignment: The user possesses standing active permissions without needing to trigger activation. Active assignments can still be time-bound (e.g., active for 30 days during a contractor engagement, after which access automatically expires).
• Permanent vs. Time-Bound Eligibility: Eligibility can be granted indefinitely or bounded to specific start and end dates.

---

Activation Settings & Workflow Rules

Administrators configure custom settings for each role managed by PIM:

1. Maximum Activation Duration: Restricts how long a single activation window can last (configurable from 1 to 24 hours; recommended 4 to 8 hours max).
2. Require Multi-Factor Authentication: Forces the user to complete an MFA prompt during activation, even if their current session already completed MFA.
3. Require Business Justification & Ticket Information: Enforces entering a mandatory text justification and ticket reference number from an IT Service Management (ITSM) system (e.g., ServiceNow ticket ID).
4. Require Approval: Routes activation requests to designated individual approvers or approval groups.

Multi-Stage Approval Workflows

For critical roles (such as Global Administrator or Key Vault Contributor), PIM supports Multi-Stage Approval:

• Stage 1 Approver (e.g., Team Lead) reviews and approves -> Stage 2 Approver (e.g., Security Operations Lead) reviews and approves -> Activation granted.
• If an approver fails to respond within the approval timeout window (default: 24 hours), the request automatically cancels.

---

PIM for Entra Roles vs. PIM for Azure Resources

PIM governs two distinct identity and permission structures across Microsoft Azure:

---

PIM for Groups (Privileged Access Groups)

Managing PIM activation settings independently for dozens of separate Azure RBAC and Entra roles creates heavy administrative complexity. PIM for Groups (formerly Privileged Access for Groups) simplifies this by allowing organizations to manage eligibility and activation for membership or ownership of a security group.

                                  +---------------------------------------+
                                  |    Role-Assignable Security Group     |
                                  |       "Cloud Architecture Admins"     |
                                  +---------------------------------------+
                                       /              |              \
                                      /               |               \
                                     v                v                v
                          [ Entra Role: ]     [ Azure RBAC: ]    [ Azure RBAC: ]
                          User Administrator   Sub Contributor    Key Vault Admin

How PIM for Groups Operates

1. An administrator creates a Security Group or Microsoft 365 Group with the property isAssignableToRole = true (Role-Assignable Group).
2. Entra Directory roles and Azure RBAC roles are assigned to the group.
3. Users are assigned Eligible Member or Eligible Owner status on the PIM Group.
4. When a user activates their eligibility in PIM for Groups, they are temporarily added as an active member of the group, instantly acquiring all underlying RBAC and Entra permissions assigned to that group.

---

Access Reviews Setup & Governance Lifecycle

To prevent "access creep" (users retaining eligible access long after changing job roles), PIM includes automated Access Reviews.

Access Review Lifecycle Phases

1. Scope Definition: Select target roles or groups to review (e.g., all users eligible for Global Administrator).
2. Reviewer Assignment: Assigned to Self-Review, Specific Users/Groups, Group Owners, or Managers (utilizing the manager attribute from Entra ID).
3. Recurrence: Configured as One-time, Monthly, Quarterly, Semi-annually, or Annually.
4. System Recommendations: Machine learning insights display user activity (e.g., "Has not signed in within 30 days") to guide reviewers.
5. Auto-Remediation Execution: Configures automatic actions if reviewers deny access or fail to respond before the review period closes:
   • Remove Access: Revokes role assignment immediately (Best practice for Zero Trust).
   • Approve Access: Retains existing role assignment.
   • Take Recommendations: Executes the system's machine learning recommendation.

---

PIM Audit History & Alerts Engine

PIM logs all role assignments, activation requests, approvals, denials, and configuration changes into a non-repudiable audit log. Audit logs can be streamed directly to Log Analytics workspaces and Microsoft Sentinel.

The PIM Alerts Engine continuously monitors tenant role configurations and flags security risks:

• Potential Stale Accounts: Identifies accounts holding eligible roles that have not signed in recently.
• Roles Not Requiring MFA: Flags high-privilege roles configured to activate without MFA.
• Excessive Active Assignments: Alerts when administrators create standing active assignments instead of eligible JIT assignments.

---

Step-by-Step PIM Role Activation Flow