Microsoft Entra Privileged Identity Management (PIM) optimizes the management of privileged roles to Microsoft Azure and Microsoft 365 resources. This contributes to the improvement of the security standards of cloud services. An additional feature is the Just-in-Time authorization, where a user is granted elevated privileges only for the period in which they are actually needed. This minimizes the risk of misuse and unauthorized access.
This guide explains how a user can apply for a Microsoft Entra role or Microsoft Azure role for a specific period of time and how an administrator can efficiently manage this requests.
Prerequisites and Licensing
For the Microsoft Entra Privileged Identity Management (PIM) feature, one of the following licenses is required:
- Microsoft Entra ID P2
- Enterprise Mobility + Security E5
An overview of Microsoft 365 license packages with their features can be found at https://m365maps.com.
In order to have the authority to approve or deny requests for Microsoft Entra roles or Microsoft Azure roles, it is necessary to be a member of one of the following Microsoft Entra roles:
- Global Administrator
- Privileged Role Administrator
The basic configuration of Microsoft Entra Privileged Identity Management (PIM) is complete. The instructions for the configuration can be found here.
User Activation of Microsoft Entra roles or Microsoft Azure roles
Every user has the ability to independently activate their assigned Microsoft Entra roles or Microsoft Azure roles. This can be done by the user in the Microsoft Entra admin center or via the Microsoft Authenticator App.
Activation in the Microsoft Entra Admin Center
The user interface of Microsoft Entra Privileged Identity Management (PIM) is seamlessly integrated into the Microsoft Entra admin center (https://entra.microsoft.com). Through this intuitively designed interface, users can request privileged Microsoft Entra roles or Microsoft Azure roles.
Access User Interface in Microsoft Entra admin center (https://entra.microsoft.com) > Identity governance > Privileged Identity Management > My Roles.
The available roles are shown under Microsoft Entra roles (1) > Eligible assignments or Azure resources (2) > Eligible assignments.
Select the desired role by Activate.
The additional details for the role are shown for editing and can be filled out.
- The start time for the role is specified at Custom activation start time. If the role is to be active immediately after approval, this option must be deactivated.
- Specify the duration, the maximum duration has been adjusted in the basic configuration of the role.
- Ticket information
- Reason for requesting the role, this is communicated to the approver.
After clicking Activate, the activations are checked. If the permissions were activated without a custom start time, the website is automatically reloaded. This allows the permissions to be applied immediately.
After the request has been approved or denied, a corresponding notification is sent via email.
The end time of a Microsoft Entra role (1) or Microsoft Azure role (2) is shown under Active assignments.
Activation with the Microsoft Authenticator App
The Microsoft Authenticator App, available for iOS and Android, allows for a convenient activation of Microsoft Entra roles or Microsoft Azure roles directly via the mobile device.
The available roles are shown in the Microsoft Authenticator App under Privileged Identity Management > Manage my roles > Microsoft Entra roles (1) or Microsoft Azure roles (2).
Click on the desired role.
Click on Activate under action.
The additional details for the role are shown for editing and can be filled out.
- The start time for the role is specified at Activation start time. If the role is to be active immediately after approval, this option must be deactivated.
- Specify the duration, the maximum duration has been adjusted in the basic configuration of the role.
- Ticket information
- Reason for requesting the role, this is communicated to the approver.
After the Activate button has been clicked, the activations are checked.
After the request has been approved or denied, a corresponding notification is sent via email.
The end time of a Microsoft Entra role or Microsoft Azure role is shown under Privileged Identity Management > Manage my roles > Microsoft Entra roles or Microsoft Azure roles > Active.
Approve or deny requests for activation of Microsoft Entra roles or Microsoft Azure roles
The request can be further processed in the Microsoft Entra admin center or in the Microsoft Authenticator App.
Microsoft Entra admin center
As soon as a Microsoft Entra role or Microsoft Azure role is requested, all approval-eligible administrators are notified. If no specific administrators were set during the basic configuration of the role, all users with the following Microsoft Entra roles receive a notification:
- Global Administrator
- Privileged Role Administrator
By simply clicking on Approve or deny, the request can be processed immediately.
Microsoft Entra Privileged Identity Management now shows all pending requests for approval for Microsoft Entra roles and Microsoft Azure roles. These pending requests can either be approved or denied.
The decision on whether the request is approved or denied will be communicated to the requester via email.
Microsoft Authenticator App
The Microsoft Authenticator App, available for iOS and Android, allows for a convenient approval or denial of Microsoft Entra roles or Microsoft Azure roles directly from the mobile device.
The pending requests are shown in the Microsoft Authenticator App under Privileged Identity Management > Approve Requests > Microsoft Entra roles or Microsoft Azure roles.
Select request
Select Approve
Fill out the reason for approval and click Approve.
The request has been successfully approved.
The decision on whether the request is approved or denied will be communicated to the requester via email.
Follow me on LinkedIn to always stay updated on my recent posts.
Was this post helpful to you? Show your enthusiasm with the delightful aroma of a freshly brewed coffee for me!
