Protecting admin accounts with Azure AD PIM
In Chapter 2, Governance and Security, we discussed the fact that we often see customer environments in which administrators have a huge set of privileges they do not necessarily need. We also discussed Separation of Duties (SoD) and the fact that no one should have more privileges than are required for doing a particular job. Now, what if you could even reduce that set of access rights to a particular point in time or time range? Or what if you need an approval process for granting privileged access? Maybe you want to monitor the usage of privileged roles or want to decide whether a person still needs privileged access rights?
Azure AD PIM is a service that offers several features that help you further protect privileged accounts, some of which are the following:
- Just-in-time and time-bound privileged access
- Approval to activate privileged roles
- Access reviews to ensure that roles are still needed
- Enforcing MFA for...
