Privileged Identity Management

Lesson: Privileged Identity Management (PIM)

1. Introduction: The Need for PIM

In modern enterprise environments, identity is the new perimeter. While most users require standard access to perform their daily tasks, a small subset of users—system administrators, cloud architects, and security engineers—require elevated permissions to manage critical infrastructure.

Privileged Identity Management (PIM) is a service that enables you to manage, control, and monitor access to important resources in your organization. The core philosophy of PIM is Just-In-Time (JIT) and Just-Enough-Administration (JEA). Instead of granting permanent "Global Admin" or "Root" access, PIM allows users to activate these roles only when needed, for a limited duration, and with an audit trail.

Why do we need PIM?

• Reduced Attack Surface: Permanent standing privileges are a goldmine for attackers. If a credential is stolen, the attacker has immediate, unrestricted access.
• Compliance: Regulations (like GDPR, HIPAA, or SOC2) require strict auditing of who accessed sensitive data and why.
• Human Error: Even well-intentioned administrators can accidentally delete resources or misconfigure services. PIM enforces a "cooling-off" period and approval workflows to prevent impulsive actions.

2. Core Concepts and Practical Implementation

PIM operates on a lifecycle model. An identity is not "privileged" by default; it must undergo a request, approval, and expiration process.

The PIM Lifecycle

1. Eligibility: A user is assigned an "eligible" role. They do not have the permissions yet.
2. Activation: When the user needs to perform a task, they request activation of the role via a portal or API.
3. Approval: If configured, a designated approver reviews the request.
4. Expiration: The role is automatically revoked after the specified duration (e.g., 2 hours).

Practical Example: Azure PIM

In Azure AD (Microsoft Entra ID), PIM is the gold standard for managing elevated roles.

Scenario: A junior administrator needs to perform a one-time configuration change on a production database. Instead of giving them "Owner" access permanently, you assign them the "Contributor" role as Eligible.

Activation Workflow:

1. The user logs into the Microsoft Entra admin center.
2. They navigate to My Roles.
3. They click Activate.
4. They provide a "Business Justification" (e.g., "Ticket #402: Database maintenance").
5. The request triggers an email to the IT Manager for approval.
6. Once approved, the user receives the role for exactly 1 hour.

3. Automation and Code Snippets

While the UI is great for occasional tasks, organizations often use Infrastructure as Code (IaC) or scripts to manage eligibility at scale. Below is an example using the Microsoft Graph PowerShell SDK to assign an eligible role to a user.

# Connect to Graph with appropriate scopes
Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"

# Define the user and the role (e.g., Global Reader)
$userId = "user-guid-here"
$roleDefinitionId = "role-definition-guid-here"
$directoryScopeId = "/"

# Assign the user as eligible for the role
New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest `
    -RoleDefinitionId $roleDefinitionId `
    -DirectoryScopeId $directoryScopeId `
    -PrincipalId $userId `
    -ScheduleRequestType "AdminAssign" `
    -Action "AdminAssign" `
    -ScheduleInfo @{
        StartDateTime = (Get-Date).ToString("yyyy-MM-ddTHH:mm:ssZ")
        Expiration = @{
            Type = "AfterDuration"
            Duration = "P365D" # Valid for 1 year
        }
    }

Note: The P365D duration refers to the eligibility window, not the activation duration. The actual activation duration is usually capped at 4–8 hours by organizational policy.

4. Best Practices and Common Pitfalls

Best Practices

• Enforce Multi-Factor Authentication (MFA): Never allow the activation of a privileged role without a strong MFA challenge.
• Implement Approval Workflows: For high-impact roles (e.g., Global Admin), require at least two people to approve the activation.
• Regular Access Reviews: Use PIM's built-in "Access Review" feature to periodically audit who still needs their eligible assignments. Remove those who no longer require access.
• Alerting: Configure alerts for when roles are activated or when new assignments are made.

Common Pitfalls

• The "Break-Glass" Account: Organizations often forget to exclude at least two "break-glass" accounts (cloud-only, permanent global admins with complex passwords stored in a physical safe) from PIM policies. If your PIM service has an outage, you could be locked out of your own tenant.
• Over-Provisioning: Assigning users to too many eligible roles. Only grant the minimum privilege required for the job.
• Ignoring Audit Logs: PIM generates extensive logs. Failing to monitor these logs means you are blind to potential abuse of the system.

5. Key Takeaways

• PIM is not just for users: It is a governance framework that shifts the security model from "Always-On" to "On-Demand."
• Security by Design: By removing standing access, you eliminate the risk of a compromised account having permanent administrative power.
• Compliance is Built-in: Automated audit trails and justification requirements make satisfying auditors significantly easier.
• Automation is Essential: Use APIs and IaC to manage PIM assignments to ensure consistency and reduce manual administrative overhead.
• Always have a backup: Never lock yourself out. Maintain "Break-Glass" accounts that are excluded from conditional access or complex PIM workflows to ensure emergency recovery.

This concludes the lesson on Privileged Identity Management. Remember: Access is a privilege, not a right—manage it accordingly.