HackBlue

Tools · Cloud security · 19 / 24

Just-in-time admin access with Entra Privileged Identity Management (PIM)

Replace standing administrator rights with eligible assignments that require activation, justification, MFA, and optional approval, and audit who activated what.

9 min read · practice only with authorization

Standing access is the problem

An account that is permanently Global Administrator is valuable every minute of every day, whether or not it is being used. Privileged Identity Management makes the assignment eligible instead: the user must activate the role for a limited time, providing justification and passing MFA, and optionally waiting for an approver.

Role settings to configure

For each role, set maximum activation duration, require MFA on activation, require justification and ticket information, require approval for the most sensitive roles, and send notifications on activation. Access reviews can periodically ask owners to confirm that eligible users still need the role.

  • Keep permanent assignments only for break-glass accounts.
  • Require approval for Global Administrator and Privileged Role Administrator.
  • Alert on activations outside business hours.

Lab: activate and audit

In a tenant with Entra ID P2 trial licensing, make a test user eligible for the Security Reader role with a one-hour maximum and MFA required. Sign in as the user, open My roles in PIM, activate with a justification, and confirm the role appears. Then open the PIM audit history and the Entra audit log and find the activation record with its justification and expiry.

What good looks like

A healthy tenant has a handful of permanent assignments, all of them emergency accounts, and a steady trickle of short, justified activations. Long activation windows, missing justifications, and permanent assignments created outside PIM are findings.

Diagram

Eligible to active

  1. Eligible

    User holds the right to request the role but has no permissions yet.

  2. Activate

    User requests the role, passes MFA, and provides justification.

  3. Approve

    For sensitive roles, an approver accepts or denies.

  4. Active

    Permissions apply until the time window expires, then are removed automatically.

Check yourself

1. A user can request a role but has no permissions until they do. What is the assignment type?

2. What happens when a PIM activation window ends?

3. Which accounts typically keep permanent active admin assignments?