Require approval to modify access to Privileged groups

Ryan Pighin 66 Reputation points
2024-09-05T21:33:52.8533333+00:00

We recently worked with a 3rd party Security company to assess our Azure env. We did get hit for having one admin still set as a global admin (we are still in the process of implementing Privileged Identity Management). We know it was a big strike and they mentioned if the admin ever went rogue, he could remove access for everyone and lock people out (which we understand). But the admin brought up a great question. What is stopping him from logging in, requesting Global Admin via PIM and then going full rogue that way? Is there a way we can set up some sort of approval process for adding/modifying/removing users from a Privileged group or from PIM set up? We do have alerting set up on this, but that won't help us if we are removed. Hope this makes sense. Thought it was an interesting perspective on access

Microsoft Identity Manager
Microsoft Identity Manager
A family of Microsoft products that manage a user's digital identity using identity synchronization, certificate management, and user provisioning.
691 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
21,585 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vasil Michev 105.1K Reputation points MVP
    2024-09-06T07:46:00.52+00:00

    You can certainly set up approvals in PIM. However, having at least two "break-glass" GA accounts is recommended, so you can use this as an excuse :)

    As detailed in the official guidance on this, the account(s) should have permanent assignment as to remove any dependence on PIM. To prevent any abuse, store the credentials for said account(s) in a manner that requires additional approval (for example, use a FIDO key stored in a locked cabinet/safe and make sure the GA does not have direct access to it).

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.