Describing the capabilities of PIM
In the previous sections, we discussed Identity Governance as it pertains to user access packages for applications and SharePoint sites. A major area of Identity Governance that we need to manage is privileged access based on administrative user accounts. In this book, we have identified administrator roles necessary to manage services within Azure AD. As we continue to add and activate these administrative roles within our tenant, we begin to increase the attack surface that someone that gains unauthorized access to a compromised account may have elevated privileges.
As identity and access administrators, it is our duty to protect and defend this layer through utilizing the concepts of zero-trust and the principle of least privilege to assign and manage these administrator accounts. You should have a clear strategy with defined job tasks for every administrator user account to plan for the proper assignment of these roles. This strategy should...