azure-pim

Name: azure-pim
Author: vinayaklatthe

55installs34forks

How to install azure-pim?

vinayaklatthe/microsoft-security-skills/azure-pim

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-pim

Installs into the current project.

Summary

Guidance for Microsoft Entra Privileged Identity Management (PIM) — just-in-time, time-bound, approval-based, audited elevation for Entra roles, Azure resource roles, and privileged groups. Covers eligible vs active assignments, activation controls (MFA + approval + justification

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Entra Privileged Identity Management (PIM)
2
3	PIM provides just-in-time, time-bound, approval-based, and audited elevation for privileged
4	roles - eliminating standing administrative access and reducing the attack surface for
5	high-value accounts. Requires Entra ID P2.
6
7	## When to use
8	Governing privileged access to Entra roles, Azure RBAC roles, and privileged groups. Use this
9	skill for moving permanent assignments to eligible, configuring activation controls, and
10	running recurring access reviews.
11
12	Do not use this skill for resource access packages (`entra-id-governance`) or risk
13	detection (`entra-id-protection`).
14
15	## Pick activation controls by role tier
16
17	\| Role tier \| Examples \| Approval \| MFA strength \| Max activation duration \|
18	\|---\|---\|---\|---\|---\|
19	\| Tier 0 - control plane \| Global Admin, Privileged Role Admin, Privileged Auth Admin \| Required (2 approvers) \| Phishing-resistant \| 1 hour \|
20	\| Tier 0 - Azure \| Owner on management group / root subscription \| Required \| Phishing-resistant \| 2 hours \|
21	\| Tier 1 - workload admin \| Exchange Admin, SharePoint Admin, Intune Admin \| Required (1 approver) \| Phishing-resistant \| 4 hours \|
22	\| Tier 1 - Azure \| Owner / Contributor on production subscription \| Justification + ticket \| MFA \| 4 hours \|
23	\| Tier 2 - operational \| Helpdesk, Reports Reader, Security Reader \| Justification \| MFA \| 8 hours \|
24
25	> Rule of thumb: the two-approver requirement on Global Admin is the single highest-
26	> value PIM control. It blocks self-elevation and forces a witness for every tenant-wide
27	> change.
28
29	## Approach
30
31	1. Inventory permanent assignments — Use `Get-MgRoleManagementDirectoryRoleAssignment` and
32	the Azure portal `Assignments` view per subscription. Categorise by tier. Target: zero
33	standing assignments outside break-glass.
34	*Verify: `PIM → Entra roles → Assignments → Active` shows only break-glass accounts for
35	Global Admin.*
36
37	2. Convert to eligible in waves — Tier 2 first (low blast radius if activation flow
38	breaks), then Tier 1, then Tier 0. Give admins 7 days notice + a walkthrough video.
39	Verify: weekly activation count rises as expected; no admin complaints about lost access.
40
41	3. Configure activation settings per role — Match the tier table above. Phishing-resistant
42	MFA = require the authentication strength, not generic MFA.
43	Verify: Global Admin activation requires 2 approvers and phishing-resistant strength.
44
45	4. PIM for Groups — Use for privileged groups that aren't Entra roles (e.g. "Tier 0
46	Admins" group with multiple role assignments, AD-synced groups holding sensitive RBAC).
47	Activate the group, not each role individually.
48
49	5. PIM for Azure resources — Onboard subscriptions and management groups. Convert Owner
50	and User Access Administrator to eligible. Scope time-bound assignments narrowly (resource
51	group, not subscription, where possible).
52
53	6. Recurring access reviews — Quarterly for Tier 0, bi-annually for Tier 1. Reviewer is
54	the role assignee's manager, not the admin team. "No response" defaults to remove (with
55	24-hour grace period notification).
56	Verify: review completion rate > 90%; removed assignments captured in audit log.
57
58	7. Alerts and audit — Enable: "Too many global admins", "Roles activated outside PIM",
59	"Activation doesn't require approval". Stream PIM audit (`AuditLogs` table) to Sentinel.
60
61	## Guardrails
62	- Two break-glass accounts with permanent Global Admin, excluded from PIM. Monitored on
63	every sign-in. If PIM has an outage, you still have a way in.
64	- Two approvers for Global Admin activation. A single approver = self-approval if both
65	approvers are admins. Two breaks that loop.
66	- Phishing-resistant MFA for Tier 0 activation. SMS MFA at Global Admin elevation is
67	unacceptable in 2026.
68	- Time-bound, narrow scope for Azure RBAC. Resource group > subscription > management
69	group. Tighter scope = lower blast radius if compromised.
70	- **

People who liked this also viewed

6 picks

Type

azure-pim

55installs34forks

View on GitHub

How to install azure-pim?

vinayaklatthe/microsoft-security-skills/azure-pim

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-pim

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Entra Privileged Identity Management (PIM)
2
3	PIM provides just-in-time, time-bound, approval-based, and audited elevation for privileged
4	roles - eliminating standing administrative access and reducing the attack surface for
5	high-value accounts. Requires Entra ID P2.
6
7	## When to use
8	Governing privileged access to Entra roles, Azure RBAC roles, and privileged groups. Use this
9	skill for moving permanent assignments to eligible, configuring activation controls, and
10	running recurring access reviews.
11
12	Do not use this skill for resource access packages (`entra-id-governance`) or risk
13	detection (`entra-id-protection`).
14
15	## Pick activation controls by role tier
16
17	\| Role tier \| Examples \| Approval \| MFA strength \| Max activation duration \|
18	\|---\|---\|---\|---\|---\|
19	\| Tier 0 - control plane \| Global Admin, Privileged Role Admin, Privileged Auth Admin \| Required (2 approvers) \| Phishing-resistant \| 1 hour \|
20	\| Tier 0 - Azure \| Owner on management group / root subscription \| Required \| Phishing-resistant \| 2 hours \|
21	\| Tier 1 - workload admin \| Exchange Admin, SharePoint Admin, Intune Admin \| Required (1 approver) \| Phishing-resistant \| 4 hours \|
22	\| Tier 1 - Azure \| Owner / Contributor on production subscription \| Justification + ticket \| MFA \| 4 hours \|
23	\| Tier 2 - operational \| Helpdesk, Reports Reader, Security Reader \| Justification \| MFA \| 8 hours \|
24
25	> Rule of thumb: the two-approver requirement on Global Admin is the single highest-
26	> value PIM control. It blocks self-elevation and forces a witness for every tenant-wide
27	> change.
28
29	## Approach
30
31	1. Inventory permanent assignments — Use `Get-MgRoleManagementDirectoryRoleAssignment` and
32	the Azure portal `Assignments` view per subscription. Categorise by tier. Target: zero
33	standing assignments outside break-glass.
34	*Verify: `PIM → Entra roles → Assignments → Active` shows only break-glass accounts for
35	Global Admin.*
36
37	2. Convert to eligible in waves — Tier 2 first (low blast radius if activation flow
38	breaks), then Tier 1, then Tier 0. Give admins 7 days notice + a walkthrough video.
39	Verify: weekly activation count rises as expected; no admin complaints about lost access.
40
41	3. Configure activation settings per role — Match the tier table above. Phishing-resistant
42	MFA = require the authentication strength, not generic MFA.
43	Verify: Global Admin activation requires 2 approvers and phishing-resistant strength.
44
45	4. PIM for Groups — Use for privileged groups that aren't Entra roles (e.g. "Tier 0
46	Admins" group with multiple role assignments, AD-synced groups holding sensitive RBAC).
47	Activate the group, not each role individually.
48
49	5. PIM for Azure resources — Onboard subscriptions and management groups. Convert Owner
50	and User Access Administrator to eligible. Scope time-bound assignments narrowly (resource
51	group, not subscription, where possible).
52
53	6. Recurring access reviews — Quarterly for Tier 0, bi-annually for Tier 1. Reviewer is
54	the role assignee's manager, not the admin team. "No response" defaults to remove (with
55	24-hour grace period notification).
56	Verify: review completion rate > 90%; removed assignments captured in audit log.
57
58	7. Alerts and audit — Enable: "Too many global admins", "Roles activated outside PIM",
59	"Activation doesn't require approval". Stream PIM audit (`AuditLogs` table) to Sentinel.
60
61	## Guardrails
62	- Two break-glass accounts with permanent Global Admin, excluded from PIM. Monitored on
63	every sign-in. If PIM has an outage, you still have a way in.
64	- Two approvers for Global Admin activation. A single approver = self-approval if both
65	approvers are admins. Two breaks that loop.
66	- Phishing-resistant MFA for Tier 0 activation. SMS MFA at Global Admin elevation is
67	unacceptable in 2026.
68	- Time-bound, narrow scope for Azure RBAC. Resource group > subscription > management
69	group. Tighter scope = lower blast radius if compromised.
70	- **

People who liked this also viewed

6 picks

Type