Privileged Access Management in M365

Privileged Access Management (PAM) in Microsoft 365 is a set of features within Microsoft Entra ID (formerly Azure AD) that provides just-in-time (JIT) privileged access, time-bound activation, and approval workflows for administrative roles. The primary goal is to eliminate standing privileged access—where users permanently hold high-privilege roles like Global Administrator—and replace it with ephemeral, auditable access that users must request and justify.

PAM addresses the principle of least privilege and reduces the attack surface from compromised privileged accounts. In Microsoft 365, PAM is implemented through Privileged Identity Management (PIM) and Privileged Access Groups (PAGs). PIM allows activation of Azure AD roles and Azure resource roles on demand, while PAGs extend JIT access to Microsoft 365 workloads like Exchange Online, SharePoint, and Security & Compliance Center. The MS-102 exam emphasizes PIM for Azure AD roles and the use of Privileged Access Groups for workload-specific elevation.

PAM relies on a multi-step activation process: 1. Eligibility Assignment: An administrator assigns a user as eligible for a privileged role (e.g., Global Administrator) via PIM. The user does not have active permissions until they activate. 2. Activation Request: The user initiates activation through the Microsoft Entra admin center, Microsoft 365 admin center, or via PowerShell/Graph API. They must provide a reason and duration (default max 8 hours, configurable). 3. Approval Workflow: If the role requires approval (configurable per role), the request goes to designated approvers. Approvers receive email notifications and can approve/deny via the admin center or email. 4. Time-Bound Activation: Once approved, the user’s role is activated for the requested duration. The activation is tied to the user’s session; if the session ends, the activation may be extended or must be re-requested. 5. Audit Logging: Every activation, approval, and usage is logged in the Azure AD audit logs and Microsoft 365 unified audit log.

To configure PIM for Azure AD roles:

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "PrivilegedAccess.ReadWrite.AzureAD", "RoleManagement.ReadWrite.Directory"

# Get Azure AD role definitions
Get-MgRoleManagementDirectoryRoleDefinition | Select Id, DisplayName

# Assign user as eligible for Global Administrator
$roleId = (Get-MgRoleManagementDirectoryRoleDefinition -Filter "DisplayName eq 'Global Administrator'").Id
$userId = (Get-MgUser -Filter "UserPrincipalName eq 'user@domain.com'").Id
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -Action "AdminAssign" -PrincipalId $userId -RoleDefinitionId $roleId -DirectoryScopeId "/" -ScheduleInfo @{ StartDateTime = (Get-Date).ToUniversalTime(); Expiration = @{ Type = "NoExpiration" } }

To configure PIM settings for a role (e.g., set max activation duration to 4 hours):

$settings = Get-MgRoleManagementDirectoryRoleSetting -UnifiedRoleManagementPolicyId "RoleManagementPolicy_<roleId>"
$settings.Rules | Where-Object {$_.Id -eq "Expiration_EndUser_Activation"} | Set-MgRoleManagementDirectoryRoleSetting -AdditionalProperties @{ "setting" = @{ "value" = "PT4H" } }

To activate a role via PowerShell:

$activation = New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest -Action "SelfActivate" -PrincipalId $userId -RoleDefinitionId $roleId -DirectoryScopeId "/" -Justification "Need for incident response" -ScheduleInfo @{ StartDateTime = (Get-Date).ToUniversalTime(); Expiration = @{ Type = "AfterDuration"; Duration = "PT2H" } }

For Privileged Access Groups:

# Create a group and mark as Privileged Access Group
New-MgGroup -DisplayName "Exchange Admins" -MailEnabled:$false -SecurityEnabled -MailNickname "ExchangeAdmins" -GroupTypes @()
$groupId = (Get-MgGroup -Filter "DisplayName eq 'Exchange Admins'").Id

# Assign user as eligible member
New-MgGroupMember -GroupId $groupId -DirectoryObjectId $userId

# Enable PIM for the group (requires Azure AD Premium P2)
# This is done via the Microsoft Entra admin center under Identity Governance > Privileged Access Groups

PAM integrates with: - Microsoft Entra ID Governance: Provides access reviews, entitlement management, and PIM. PIM is a core component. - Conditional Access: Can require MFA or compliant device during activation via PIM settings. - Microsoft 365 Defender: Alerts on suspicious privileged activations. - Azure Monitor: Audit logs can be streamed to Log Analytics for advanced querying. - Microsoft Purview Compliance Portal: PAM activations are logged in the unified audit log for eDiscovery and compliance.

PAM does not replace Azure AD roles like Global Administrator; it restricts their use. For workloads like Exchange Online, PAM uses Privileged Access Groups (PAGs), which are separate from Azure AD roles. The MS-102 exam tests the distinction: PIM for Azure AD roles, PAGs for workload-specific admin centers.

Contoso, a financial services company with 5,000 employees, needed to comply with SOX and PCI DSS requirements that administrative access be temporary and approved. They had 12 Global Administrators with permanent access, which auditors flagged as a high risk. Contoso implemented PIM for all Azure AD roles, requiring approval for Global Administrator activation. They configured a maximum activation duration of 4 hours and required MFA at activation. They also set up access reviews quarterly to remove users who no longer needed eligibility. The result: standing Global Administrators dropped to zero, and all privileged actions were traceable to specific activation requests. The main challenge was user training—administrators initially forgot to activate and complained about friction. Contoso mitigated this by creating a custom activation portal and sending reminders. Performance was not an issue; PIM is a control plane service with negligible latency.

Fabrikam, a healthcare provider, needed to grant temporary admin access to Exchange Online for mailbox migrations without giving permanent Global Admin rights. They used Privileged Access Groups (PAGs) by creating an 'Exchange Migrations' group and assigning it as a Privileged Access Group with PIM. Users were made eligible members. When they needed to perform migration tasks, they activated the group membership via PIM, which gave them the Exchange Administrator role (via the group's assigned Azure AD role). The activation required approval from a senior admin and was limited to 2 hours. This allowed Fabrikam to comply with HIPAA audit requirements. A common misconfiguration was forgetting to assign the group an Azure AD role—the group itself grants no permissions until a role is assigned. Fabrikam learned to verify that the group had the 'Exchange Administrator' role assigned via Azure AD. They also set up alerting for activations outside business hours using Microsoft Sentinel.

Tailwind Traders attempted to use PAM but misconfigured the approval workflow by not adding approvers. As a result, activation requests were never approved, and administrators were locked out. They also set the max activation duration to 0 hours, which caused activations to fail. The fix was to configure at least one approver and ensure the duration was between 1 and 8 hours. Tailwind also learned that PAM does not protect against lateral movement if a privileged user's session is hijacked—they needed to combine PAM with Conditional Access policies for device compliance and session risk. This scenario is common: administrators assume PAM alone prevents all privileged attacks, but it only controls elevation, not session security.