Harden Azure privileged access with least-privilege RBAC, PIM eligibility, approval, time limits, access reviews, managed identities, and audit evidence.
Privilege should be specific, temporary, and reviewable
Azure privilege spans two connected authorization systems. This Azure PIM and RBAC privileged access guide examines Microsoft Entra roles that control users, applications, authentication, Conditional Access, and role administration, plus Azure role-based access control for management and data operations across management groups, subscriptions, resource groups, and resources. A secure design must review both systems, their inheritance, custom roles, classic administrators, service principals, managed identities, and any path that can grant additional access.
Microsoft Entra Privileged Identity Management can make eligible access time-bound, require activation controls, generate notifications, and support access reviews. PIM reduces standing privilege, but it does not correct an overpowered role, excessive scope, weak approver design, or an identity that should not be eligible at all.
Authorization map
Azure RBAC inheritance means a role assigned at a management group or subscription may silently grant access to many resources. Conversely, a role that looks narrow by name may contain broad wildcard actions. Data-plane roles must be examined separately for services such as Storage, Key Vault, databases, Kubernetes, and Backup. A person can have little control-plane authority yet still read sensitive data, or strong control-plane authority that allows the person to grant themselves data access.
Privilege inventory
Build one reconciled view rather than reviewing a few well-known administrators. Include direct and group-based assignments, eligible and active assignments, inherited roles, custom roles, service principals, managed identities, classic administrators, and Azure Lighthouse delegation.
| Field | Why it matters | Risk signal | Evidence |
|---|---|---|---|
| Identity type | User, guest, group, service principal, managed identity, or external delegation changes lifecycle and authentication | Guest or application identity with broad authority and no current owner | Object ID, type, source tenant, owner, last use |
| Role definition | Built-in and custom roles grant different management and data actions | Owner, User Access Administrator, Contributor, wildcard custom role, or privilege-escalation action | Role definition JSON and permission analysis |
| Scope | Higher assignments inherit broadly | Tenant root, management group, or subscription role without business need | Scope resource ID and inheritance trace |
| Assignment state | Active standing access creates a larger exposure window than eligible access | Permanent active privilege for routine or infrequent work | Assignment type, start, end, PIM status |
| Activation control | MFA, authentication strength, approval, justification, ticket, duration, and notification reduce misuse and improve evidence | No approval for destructive role or excessive activation duration | PIM role settings and recent activation records |
| Grant authority | Some roles can create new assignments or elevate access | User Access Administrator or Owner combined with weak monitoring | Role assignment activity and alert coverage |
| Last use and review | Unused privilege often survives organizational change | No recorded activation, stale guest, dormant application, overdue review | Sign-ins, activity log, access review, owner attestation |
| Emergency purpose | Break-glass privilege requires separate custody and monitoring | Emergency account used for ordinary administration | Procedure, test record, sign-in alert, credential custody |
Just-in-time control
PIM configuration
In Microsoft Entra ID Governance, open Privileged Identity Management and select Microsoft Entra roles or Azure resources. For Azure resources, discover the relevant management group, subscription, resource group, or resource. Begin with critical production scopes and roles capable of granting access or disabling protection.
Convert permanent active access to eligible where operationally appropriate. Limit eligibility duration when contractors, projects, temporary duties, or vendor access have known end dates. Permanent eligibility still requires recurring review.
Require MFA or a Conditional Access authentication context with an appropriate authentication strength. Require a meaningful justification and a ticket or change identifier when the process supports it. Choose the shortest practical activation duration; do not normalize an eight-hour window for a task that usually takes thirty minutes.
Require approval for roles such as Global Administrator, Privileged Role Administrator, Owner, User Access Administrator, and destructive service roles when independent authorization is feasible. Choose at least two trained approvers for resilience. An approver should not routinely approve their own access or rely only on the requester’s text.
Notify the role owner, security team, or operations owner when privileged roles are assigned, activated, extended, or made permanent. Confirm that the distribution is monitored and that recipients know which events require investigation.
Use a non-emergency eligible account in a controlled scope. Verify the authentication requirement, approval, duration, notification, effective permission, Activity Log entries, and automatic expiration. Confirm that an unauthorized user cannot approve or extend access.
Review assignments, activations, approvals, denials, changes to role settings, and access reviews. Route identity and Azure activity logs to suitable retention when default history is shorter than the organization’s investigation or compliance need.
Azure RBAC
Start with a task inventory. Determine whether the person must view resources, restart a VM, deploy an application, manage networking, read secrets, restore backups, assign roles, or administer a database. Select the narrowest built-in role that supports the task. If no built-in role is suitable, design a custom role with explicit actions and data actions, avoid broad wildcards, test it in a nonproduction scope, version the definition, and assign an owner.
Prefer group-based assignment for human teams when group ownership and membership are governed. Do not nest groups so deeply that reviewers cannot determine effective access. Use dedicated identities for automation and separate deployment authority from runtime data access. Avoid assigning roles to individual developers at subscription scope for convenience.
Review `Microsoft.Authorization/roleAssignments/write`, `roleDefinitions/write`, policy assignment rights, managed identity assignment, virtual machine login roles, Key Vault data roles, Storage data roles, Kubernetes administrator paths, and backup security roles. These permissions can create privilege escalation even when the role name appears operational.
Access reviews
Create recurring access reviews for privileged Microsoft Entra roles and Azure resource roles where licensing and operational ownership support them. Choose reviewers who understand the work and the consequences of approval. A manager may know employment status but not technical need; a resource owner may understand the workload but not the user’s role. Use two-step or complementary review when necessary.
Require justification for approval, provide reviewers with last sign-in or activity context, send reminders, and define what happens when a reviewer does not respond. Automatic removal can improve hygiene but needs a tested exception process for critical operations. Review guest and service-principal access separately when the platform and licensing support the scenario.
Detection and evidence
Alert on new Owner, User Access Administrator, Global Administrator, Privileged Role Administrator, Conditional Access Administrator, and custom high-impact assignments. Include actor, target, scope, assignment type, correlation ID, and source.
Review unusual activation duration, repeated denials, activation outside normal operations, emergency access, approver changes, role-setting changes, permanent assignment, and extension requests.
Correlate activation with control-plane activity. Investigate role grants, policy changes, public exposure, diagnostic-setting removal, Key Vault access changes, backup security changes, or deletion of protected resources.
Monitor application credential additions, admin consent, federated credential changes, managed identity role grants, automation account changes, and dormant service principals returning to use.
Preserve PIM audit history and Azure Activity Log beyond default periods when investigation or compliance requires it. The logging and Microsoft Sentinel guide shows how to connect privilege signals to incidents and response.
CISO-led review
Ali Hassani’s experience across Microsoft infrastructure, Azure, Microsoft 365, networks, compliance, vulnerability management, and IT operations helps evaluate whether privilege is needed, whether the scope is appropriate, what could be changed, and how access can be reduced without disrupting critical work.
Official guidance
Microsoft updates Azure capabilities, portal locations, licensing, defaults, feature status, and prerequisites. Confirm the current product documentation before a production change.
Practical questions
Entra roles govern directory capabilities, while Azure RBAC governs Azure management and data actions at management groups, subscriptions, resource groups, and resources. Both must be reviewed.
No. PIM reduces standing exposure and adds activation controls, but the role permissions, assignment scope, eligible population, approvers, and monitoring must still be appropriate.
Prioritize roles that can grant access, change identity or security policy, manage production, access sensitive data, disable monitoring, alter keys, or delete backups. Exact roles depend on the architecture.
Use a frequency based on risk and change rate, with immediate review after role changes, staff or vendor transitions, incidents, acquisitions, or new production scopes. Recurring access reviews provide evidence and cleanup.
Show eligible assignments, role settings, MFA or authentication strength, approval, justification, activation duration, notifications, activity, automatic expiration, and access-review results.
About the author
Created by Ali Hassani, CISO — 25+ years of IT, cybersecurity, compliance, Microsoft infrastructure, cloud, network security, vulnerability management, and operations experience.
This material is for initial guidance only and does not replace a professional cybersecurity audit, compliance assessment, penetration test, or legal/compliance review. Validate configuration, licensing, service availability, architecture, and business impact before production changes.
This website uses essential cookies for security and operation. Optional analytics and advertising cookies help measure site use and outreach. Choose Allow or Deny. You can change your choice at any time.