Privileged Identity Management Design

Privileged Identity Management (PIM) is a service in Azure Active Directory (Azure AD) that enables you to manage, control, and monitor access to important resources in your organization. This includes access to Azure AD roles, Azure resources (such as subscriptions, resource groups, and individual resources), and other Microsoft online services like Exchange Online or SharePoint Online. PIM provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions.

PIM addresses the problem of 'standing privileges' – where users have permanent, always-on admin roles. If an attacker compromises such a user, they immediately gain full access. PIM replaces standing admin roles with just-in-time (JIT) activation: users are eligible for a role but must activate it only when needed, for a limited duration, and often with approval and multi-factor authentication (MFA).

PIM operates on top of Azure AD's directory service. When a user is assigned as 'eligible' for a role, that assignment is stored in Azure AD as an entitlement. However, the user does not have the role's permissions until they activate it. Activation involves the following:

- Role Types: PIM supports two types of roles: - Azure AD roles: Directory-level roles like Global Administrator, User Administrator, etc. - Azure resource roles: Built-in roles like Owner, Contributor, Reader, or custom roles at subscription/resource group/resource scope. - Assignment Types: - Eligible: User can activate the role when needed. - Active: User has permanent, always-on access (not recommended). - Time-bound: Active assignment with a specific end date (e.g., for temporary elevated access). - Activation Settings: - Maximum activation duration (in hours): Default 8 hours for Azure AD roles; for Azure resources default 1 hour. Configurable between 1 and 24 hours. - Require MFA on activation: Enabled by default for Azure AD roles. - Require approval: Optional; if enabled, one or two approvers can be configured. - Require justification: Always required. - Require ticket information: Optional; can require a ticket number. - Approval Workflow: Approvers are users who are themselves eligible or active for the Privileged Role Administrator role (or custom approver groups). Approvals can be delegated. - Audit History: PIM retains a log of all activations, approvals, and role changes for up to 30 days in the Azure portal. - PIM for Groups: PIM can also manage eligibility for Azure AD security groups that are assigned to roles (role-assignable groups).

PIM is primarily managed through the Azure portal (Azure AD > Privileged Identity Management) or via Microsoft Graph API and Azure AD PowerShell. Key PowerShell cmdlets:

# Get eligible assignments for a user
Get-AzureADMSPrivilegedRoleAssignment -ProviderId 'aadRoles' -Filter "userId eq 'user@domain.com'"

# Activate a role
Open-AzureADMSPrivilegedRoleAssignmentRequest -ProviderId 'aadRoles' -ResourceId 'roleId' -SubjectId 'userId' -Type 'UserAdd' -AssignmentState 'Active' -Duration 'PT8H' -Reason 'Need for incident'

# Approve a request
Approve-AzureADMSPrivilegedRoleAssignmentRequest -ProviderId 'aadRoles' -RequestId 'requestId' -Reason 'Approved'

For Azure resources, use:

# Get eligible assignments for Azure resource role
Get-AzureADMSPrivilegedResource -ProviderId 'azureResources' -Filter "externalId eq '/subscriptions/...'"

PIM is a foundational service for identity governance in Azure AD, and its proper design is critical for securing privileged access in any organization.

A large financial services company has a team of 10 IT administrators who occasionally need Global Administrator access to respond to critical security incidents. Previously, all 10 had permanent Global Admin roles, creating a high-risk standing privilege. The company deploys PIM for Azure AD roles. They create a custom role 'Incident Responder' with only necessary permissions (via custom roles) but also use Global Admin as a last resort. They configure PIM to require MFA, approval from two designated security managers, and a maximum activation duration of 4 hours. The justification must include an incident ticket number. In production, when an incident occurs, the admin requests activation via the PIM portal. The request triggers an email to the security managers, who approve within minutes. The admin then has Global Admin for 4 hours. After the incident, the role expires automatically. This reduces the attack surface significantly. The company also uses PIM alerts to notify the SOC of any activation outside business hours. A common issue is that admins forget to deactivate early, but the automatic expiry handles it. Performance is not an issue as PIM is a control plane service with minimal latency.

A SaaS company uses Azure resources across multiple subscriptions. Developers need Contributor access to specific resource groups for deployment, but only during deployment windows. The company uses PIM for Azure resources. They onboard each subscription into PIM and configure roles like 'Contributor' at the resource group scope. Developers are made eligible for these roles. Activation requires MFA and justification with a build number. Maximum duration is set to 2 hours. The deployment pipeline (Azure DevOps) uses the PIM REST API to activate the role programmatically before deployment and deactivate after. This eliminates standing Contributor access. In production, the pipeline calls the Graph API to activate the role, waits for activation (which may require approval), then runs deployment. After deployment, it deactivates. A misconfiguration could occur if the pipeline does not deactivate, but the timer handles it. The company also uses PIM to manage access to production subscriptions with stricter approval.

PIM scales to tens of thousands of users and roles. Activation requests are processed in seconds. The audit log retains 30 days of history; for longer retention, export to Log Analytics or storage account. PIM is a global service with no regional constraints.