Privileged Identity Management (PIM)

Privileged Identity Management (PIM) is an Azure AD service that enables you to manage, control, and monitor access within Azure AD and Azure resources. PIM provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions. The core principle is Just-In-Time (JIT) access: instead of users having permanent privileged roles, they can activate those roles on-demand for a limited period.

Permanent privileged role assignments are a significant security risk. If a user's credentials are compromised, the attacker gains persistent high-level access. PIM reduces the attack surface by ensuring that privileged roles are only active when needed. It also provides auditing capabilities to track who used what role and when, which is essential for compliance.

PIM operates through a combination of Azure AD roles, role assignments, activation requests, and policies. When a user is eligible for a role (i.e., assigned as eligible in PIM), they are not active in that role by default. To use the role, they must activate it by going through a workflow that may require:

Once activated, the user gets a temporary role assignment that lasts for a specified maximum duration (default 1 hour, configurable up to 24 hours). The user can then perform privileged operations. The role automatically deactivates when the duration expires.

- Activation maximum duration (hours) - Require MFA on activation - Require approval (add approvers) - Require justification - Require ticket information - Require Azure AD Conditional Access authentication context 4. Assign members: Add users or groups as eligible or active for the role. 5. Approve requests: Approvers can review and approve/deny activation requests in the PIM portal or via email.

You can manage PIM via the Azure portal, Microsoft Graph API, or PowerShell. Key PowerShell commands:

# Connect to Azure AD
Connect-AzureAD

# Get a list of role definitions
Get-AzureADMSPrivilegedRoleDefinition -ProviderId aadRoles

# Get role assignments
Get-AzureADMSPrivilegedRoleAssignment -ProviderId aadRoles

# Activate a role (requires user interaction)
Open-AzureADMSPrivilegedRoleAssignmentRequest -ProviderId aadRoles -RoleDefinitionId <roleId> -SubjectId <userId> -Type UserAdd -AssignmentState Active -Duration 1

PIM integrates with: - Azure AD Conditional Access: You can require a specific authentication context (e.g., 'Require compliant device') during activation. - Azure AD Identity Protection: PIM can use risk-based policies, e.g., require MFA if sign-in risk is medium or high. - Azure AD Privileged Access Groups: You can manage access to Azure AD roles using groups (groups assigned to roles). - Azure Resource PIM: Similar mechanism but for Azure RBAC roles (e.g., Contributor, Owner) at subscription, resource group, or resource level.

Azure AD PIM manages roles like Global Administrator, User Administrator, etc. Azure Resource PIM manages Azure RBAC roles like Owner, Contributor, etc. Both follow the same principles but are configured separately.

When a user requests activation, approvers receive an email notification. They can approve or deny in the PIM portal or via email reply. If no approver acts within the configured approval timeout (default 24 hours), the request expires. The user can see the status of their request.

PIM provides a rich audit history:

Audit logs can be exported to Azure Monitor for long-term retention and advanced analysis.

Azure AD allows you to use groups to manage role assignments. You can assign a group as eligible for a role, and then manage group membership via PIM. This simplifies role management at scale.

A large enterprise with 50,000 users has 10 Global Administrators. Previously, all had permanent access. A security audit revealed that one admin's credentials were compromised, leading to a breach. The company implements PIM for the Global Administrator role. They configure: activation duration of 2 hours, require MFA and approval from two designated approvers (CISO and IT Director). All Global Administrators are made eligible. Now, to perform sensitive tasks, an admin must request activation, get approved, and use MFA. This reduces the risk of standing privileges. The activation logs are exported to Azure Monitor for SIEM integration. Performance is not an issue as PIM is a control plane service with minimal latency.

A DevOps team manages 200 Azure subscriptions. They have Contributor access to many resources. To reduce risk, they use Azure Resource PIM for the Contributor role at the subscription level. Team members are made eligible for Contributor. They activate the role for 4 hours when deploying changes. Approval is required for production subscriptions. This ensures that no one has permanent write access to production. The team uses PIM's API to automate activation during CI/CD pipelines. Common misconfiguration: forgetting to set an expiration for eligible assignments, which can lead to indefinite eligibility. Regular access reviews are scheduled quarterly to clean up stale eligibilities.