Azure Privileged Identity Management: Enterprise Implementation Guide

Overview

Azure Privileged Identity Management (PIM), part of Microsoft Entra ID, is a privileged access control service that manages eligible and active assignments for administrative roles. Its core purpose is to minimize persistent privileged access by enforcing just-in-time (JIT) activation, MFA, approvals, ticketing metadata, and time-limited access.

Enterprises adopt PIM to reduce attack paths tied to standing admin accounts, especially for roles such as Global Administrator, Privileged Role Administrator, Owner, and User Access Administrator. PIM also improves governance with activation history, alerts, access reviews, and integration with Conditional Access and audit pipelines.

Architecture

Core components

• Microsoft Entra ID PIM for directory roles and group-based privileged access
• Azure resource PIM for subscriptions, resource groups, and resource roles
• Approval workflow for sensitive role activation
• MFA and Conditional Access for strong authentication during activation
• Audit logs and alerts streamed to Log Analytics, Microsoft Sentinel, or SIEM platforms
• Access reviews to recertify privileged assignments

Deployment models

• Cloud-native Microsoft estate: Entra roles, Azure RBAC, and Microsoft 365 admin roles managed centrally
• Hybrid enterprise: PIM combined with on-prem AD tiering, PAM vaulting, and SIEM correlation
• Group-based administration: Privileged access assigned to groups, then activated through PIM for Groups

Data flow

1. A user receives an eligible role assignment.
2. The user requests activation with justification and optional ticket number.
3. PIM evaluates policy: MFA, approval, maximum duration, Conditional Access.
4. If approved, PIM creates a temporary active assignment.
5. Activation and role use are written to Entra audit logs and can be exported to Log Analytics.
6. At expiration, the role is revoked automatically.

Implementation Guide

1. Prepare licensing and roles
   • Require Microsoft Entra ID P2 or Microsoft Entra Suite for PIM capabilities.
   • Use a break-glass account excluded from Conditional Access but tightly monitored.
2. Install tools

az extension add --name role
az extension add --name resource-graph
az login
az account set --subscription "Production-Platform-01"

1. Discover current privileged assignments

az role assignment list --all --include-inherited --query "[?roleDefinitionName=='Owner' || roleDefinitionName=='User Access Administrator' || roleDefinitionName=='Contributor'].{principalName:principalName, role:roleDefinitionName, scope:scope}" -o table

1. Move standing access to eligible access
   • In practice, Azure resource role eligibility is commonly configured through Microsoft Graph or portal because Azure CLI coverage is limited for PIM policy administration.
   • Create eligible assignments for high-risk roles and require approval for Owner and User Access Administrator.
2. Configure role settings
   • Require MFA on activation
   • Require justification and ticket information
   • Set max activation duration, typically 1-4 hours
   • Require approval for tier-0 roles
   • Enable notifications to SOC and platform owners
3. Enable audit export

WORKSPACE_ID=$(az monitor log-analytics workspace show -g rg-monitoring -n law-secops --query id -o tsv)
az monitor diagnostic-settings create --name "entra-pim-audit" --resource "/providers/Microsoft.aadiam" --workspace $WORKSPACE_ID --logs '[{"category":"AuditLogs","enabled":true},{"category":"SignInLogs","enabled":true}]'

1. Validate activation flow
   • Request activation for a test eligible role
   • Confirm MFA challenge and approval flow
   • Verify audit records in Entra and Log Analytics

Code Examples

1. Query privileged Azure RBAC assignments

az role assignment list --all --query "[?roleDefinitionName=='Owner' || roleDefinitionName=='User Access Administrator'].{principal:principalName, type:principalType, scope:scope}" -o json

2. Diagnostic settings as ARM-style JSON payload

{
  "properties": {
    "workspaceId": "/subscriptions/11111111-2222-3333-4444-555555555555/resourceGroups/rg-monitoring/providers/Microsoft.OperationalInsights/workspaces/law-secops",
    "logs": [
      {"category": "AuditLogs", "enabled": true},
      {"category": "SignInLogs", "enabled": true}
    ],
    "metrics": []
  }
}

3. Python example to pull Entra audit events from Microsoft Graph

import requests
token = "<access_token>"
url = "https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?$filter=activityDisplayName eq 'Activate eligible role assignment'"
resp = requests.get(url, headers={"Authorization": f"Bearer {token}"})
resp.raise_for_status()
for item in resp.json().get("value", []):
    print(item.get("activityDateTime"), item.get("initiatedBy", {}).get("user", {}).get("userPrincipalName"))

Security Hardening

• Enforce MFA for every activation and back it with phishing-resistant methods where possible.
• Require approval for Global Administrator, Privileged Role Administrator, Owner, and User Access Administrator.
• Use least privilege by replacing broad roles with narrower custom or built-in roles.
• Stream AuditLogs and SignInLogs to immutable retention or SIEM storage.
• Protect privileged groups with PIM for Groups and avoid direct permanent assignments.
• Encrypt downstream log storage with platform-managed or customer-managed keys where required.
• Use access reviews quarterly for all eligible and active privileged assignments.

Comparison

Troubleshooting

Error 1: Activation blocked by MFA policy

Log sample:

Correlation ID: 7f3d1d0e-0c6f-4e2e-9f1b-6cb2d4d8c5b1
Result: failure
Result detail: User did not satisfy MFA requirement during role activation
Activity: Activate eligible role assignment

Fix: Verify Conditional Access includes the user, confirm strong auth registration, and ensure the activation device can complete MFA.

Error 2: Approval timeout

Log sample:

ActivityDisplayName=Activate eligible role assignment
StatusReason=Request pending approval expired
Role=Owner
Scope=/subscriptions/9d2a4d6e-1c2b-4f1f-8c11-2d0a9f7e1234

Fix: Add backup approvers, shorten notification paths, and validate approver eligibility before production rollout.

Error 3: Missing audit export records

Log sample:

OperationName: Microsoft.Insights/diagnosticSettings/write
Status: Failed
StatusCode: 400
Message: Category 'AuditLogs' is not supported for this resource

Fix: Apply diagnostic settings to the correct Entra diagnostic resource and verify tenant-level permissions.

Best Practices

Do

• Make admins eligible, not permanent; for example, convert subscription Owner to eligible with 1-hour activation.
• Use separate admin identities; e.g., alice@corp.com for productivity and alice-admin@corp.com for privileged tasks.
• Require ticket IDs tied to ITSM changes for production role activation.
• Alert on high-risk activations such as Global Administrator outside business hours.

Don't

• Do not leave standing Global Administrator assignments except tightly controlled emergency accounts.
• Do not assign broad roles at management group scope unless operationally necessary.
• Do not rely on portal-only monitoring; export logs to SIEM for retention and correlation.
• Do not exempt privileged users from Conditional Access except documented break-glass accounts.