Skip to main content

Privileged Identity Management (PIM): Eliminating Standing Admin Privileges

The "Why" Before the "How": The Danger of Permanent Privilege​

In traditional IT administration, engineers were granted permanent domain administrator or global administrator accounts. If an engineer's workstation was compromised by a drive-by phishing attack or infostealer malware, the adversary inherited 24/7 root-level authority over the entire directory.

Microsoft Entra Privileged Identity Management (PIM) enforces the core Zero Trust tenet of Just-In-Time (JIT) access:

Standing Admin Accounts ➔ Zero Standing Privilege (Eligible Roles Only)

Administrators no longer walk around with active administrative tokens. Instead, their accounts are configured as Eligible for a role. When work needs to be performed, they must explicitly activate the role, satisfy stepped-up authentication, supply an ITIL ticket number, and state a business justification. The elevated session automatically expires after a pre-determined duration (e.g., 4 hours).

1. PIM Role Design: Active vs. Eligible​

When assigning privileged roles (Global Administrator, Intune Administrator, Privileged Authentication Administrator, Exchange Administrator), we divide assignments into two distinct categories:

flowchart TD
    subgraph Permanent [Permanent / Active Assignments]
        BG1["Break-Glass Account 1<br>(Permanent Active - FIDO2 Locked)"]
        BG2["Break-Glass Account 2<br>(Permanent Active - FIDO2 Locked)"]
    end
    subgraph PIM [PIM JIT Assignments]
        Admin["Engineering User: dario@lab.dariocruz.dev"]
        Admin -->|"1. Request Activation"| PIMEngine["Entra PIM Engine"]
        PIMEngine -->|"2. Enforce MFA & Ticket #"| Prompt["MFA Verification + Reason"]
        Prompt -->|"3. Grants Time-Bound Access"| ActiveRole["Active Global Admin<br>(Valid for 4 Hours)"]
        ActiveRole -->|"4. Auto-Deactivates"| Revoked["Reverts to Standard User"]
    end

Golden Rules of Role Eligibility​

  • Zero Standing Global Admins: Outside of the 2 emergency break-glass accounts, zero human accounts should maintain permanent active Global Administrator assignments.
  • Maximum Duration Capping: Cap high-privilege directory roles to 4 hours maximum; Tier 2 support roles (e.g., Helpdesk Administrator) capped to 8 hours.
  • Mandatory Ticketing & Justification: Engineers must provide an enterprise ticket number (e.g., CR-002 or INC-48102) and a concise operational reason before the activation token is issued.

2. Configuring PIM Role Settings for Directory Roles​

To configure role settings for Intune Administrator or Global Administrator:

  1. In the Microsoft Entra admin center, navigate to Identity Governance > Privileged Identity Management > Microsoft Entra roles > Roles.
  2. Select Intune Administrator and click Role settings > Edit.
  3. Configure the following security thresholds:
    • Activation maximum duration (hours): 4
    • On activation, require: Microsoft Entra MFA
    • Require justification on activation: Yes
    • Require ticket information on activation: Yes
    • Require approval to activate: No (or configure peer approval from a Tier 3 Senior Engineer for Global Administrator).
    • Notification recipients: Configure an administrative alert distribution list to receive an email alert whenever an elevation occurs.

3. Automated Entitlement Reviews: Access Reviews​

Privilege creep is an insidious enterprise reality: an engineer is granted temporary access for a 2-week migration project, and 6 months later they still hold the keys to the kingdom.

With Entra Access Reviews, PIM automatically schedules recurring quarterly audits:

  • Every 90 days, role owners or self-reviewers must certify that each eligible assignment is still required for active business duties.
  • If a reviewer does not respond or denies access within 14 days, the PIM engine automatically strips the eligible role assignment, guaranteeing automated least-privilege hygiene.

4. Verification: Trust, but Verify​

1. Activating an Eligible Role via PowerShell​

Engineers can activate roles programmatically via the Microsoft Graph PowerShell SDK without needing the browser GUI:

Connect-MgGraph -Scopes "RoleAssignmentSchedule.ReadWrite.Directory"

# Request Just-In-Time role elevation
$RoleDefinitionId = "62e90394-69f5-4237-9190-012177145e10" # Global Administrator
$UserId = (Get-MgUser -UserId "dario@lab.dariocruz.dev").Id

$Params = @{
    PrincipalId = $UserId
    RoleDefinitionId = $RoleDefinitionId
    Justification = "Implementing CR-002: Transitioning Conditional Access Policy"
    DirectoryScopeId = "/"
    Action = "SelfActivate"
    ScheduleInfo = @{
        StartDateTime = (Get-Date).ToUniversalTime()
        Expiration = @{
            Type = "AfterDuration"
            Duration = "PT4H" # 4 Hours
        }
    }
    TicketInfo = @{
        TicketNumber = "CR-002"
        TicketSystem = "Internal CAB"
    }
}

New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest -BodyParameter $Params

2. Auditing PIM History​

Navigate to PIM > Microsoft Entra roles > Audit history to review the cryptographic timestamp, user identity, IP address, and ticket justification for all role elevations.