introduction
in second article of PIM : we will see how to setup initial configuration for PIM before get some examples of how to use PIM best practice
let us go
who can enable PIM
any member of Global Admin Role can enable PIM
when he enabled PIM >> he will be added to (Privileged Role Administrator )
enable PIM
to enable PIM :
log in to azure portal
search for Privileged Identity Management
click consent
who can Manage PIM
as we mentioned above
any member of Global Admin Role can enable PIM (Bisan or Ahmad)
BUT when Bisan enabled PIM >> she will become PIM Admin
what does this mean ?
it means that (BISAN ) is the first global admin who enable PIM can ONLY manage PIM >>
and the other Global admins ( Ahmad) members couldn’t manage PIM unless first admin allow them
post enable PIM steps
ther eis couple of steps should be done after enable PIM , including but NOT limited to :
- start discovery process to check which users has high privileged role in your organization
- remove admins that are NO longer needed
- don’t lock your self
- create emergency account ( break glass account ) which we have fully discussed in previous article of this series identity protection
- you must decide which users should get the eligible role versus the permanently active role.
- generally : as much as possible try to make global admin as (eligible admin ) rather than ( permanent admin ) >> regarding eligible admin : we will fully discuss next article
- use access review technique to control who can use privileged role
- work with subscription/resource owners of critical services to set up Privileged Identity Management workflow for all roles inside sensitive subscriptions/resources.
- When planning, consider assigning a role to a group to manage role assignments when: you Many users are assigned to a role or You want to delegate assigning the role
- bring Azure AD role-assignable groups under management by Privileged Identity Management
most Azure AD roles manage by PIM
It’s important to prioritize protecting Azure AD roles that have the most permissions.
microsoft said that Based on usage patterns among all Privileged Identity Management customers, >> the top 10 Azure AD roles managed by Privileged Identity Management are:
- Global administrator
- Security administrator
- User administrator
- Exchange administrator
- SharePoint administrator
- Intune administrator
- Security reader
- Service administrator
- Billing administrator
- Skype for Business administrator
conclusion
NOW PIM is ready to use
next article we will see how to assign eligible privileged role to users
please join us there
