Zero standing privilege with Azure PIM

Consultants, vendors, and internal administrators all needed privileged roles in a 4,300-user tenant. Permanent assignments would have left each of those accounts holding admin rights around the clock.

• Consultant, vendor, and internal administrator accounts each needed privileged access.
• Applications could request Microsoft Graph permissions through app registrations.

1. 01Ran privileged roles through Azure PIM so accounts activated them just in time under zero standing privilege.
2. 02Required approval workflow on activation and ran periodic access validation.
3. 03Routed app registrations and API permission grants through consent policy.
4. 04Configured phishing-resistant sign-in methods: FIDO2 security keys, Windows Hello for Business, and certificate-based authentication.

Consultant, vendor, and internal administrator accounts held no standing privilege. Roles were activated when needed, with approval and periodic validation.

Device protection becomes an identity problem once an attacker can get admin rights.

• Who can grant an app access to your data?Sheet 04 / 30
• Zero standing privilege for three kinds of adminSheet 11 / 30
• Anatomy of a PIM activationSheet 12 / 30
• Least-privileged role by taskSheet 14 / 30

• Azure PIM
• Zero Trust
• Entra ID
• FIDO2
• Consent policy