Controlling access with PIM
The traditional security model defines policies such as least privileged access, meaning you should always assign the least amount of rights to any one user. However, you still need to assign administrator rights to some users.
With PIM, you can control when and for how long those rights are granted. In other words, users have to request elevated access as they need it explicitly, and this access can then be time-boxed to be automatically removed after a defined period.
This way, even if an individual account were compromised, an attacker would still not have high levels of access.
Specifically, PIM can help you by doing the following:
- Providing just-in-time elevated access to Azure AD and resources
- Assigning accounts with time-boxed start and end dates/times
- Requiring an additional approval step for elevated access
- Enforcing MFA
- Requesting justification for why access is required
- You getting notified when privileged roles are granted...