How to Configure Microsoft Entra ID Privileged Identity Management (PIM) for Azure Resources

A fundamental principle of Zero Trust security is Just-In-Time (JIT) access combined with Least Privilege. In legacy cloud environments, IT administrators are assigned permanent, standing privileges. For example, a developer might be permanently assigned the “Owner” role on an Azure Subscription. If that developer’s credentials are compromised, or their session token is stolen via an Adversary-in-the-Middle (AitM) attack, the threat actor instantly gains god-level control over the entire cloud infrastructure.

Microsoft mitigates this threat via Entra ID Privileged Identity Management (PIM). PIM eliminates standing access. Instead, users are made “eligible” for a role. When they need to perform administrative tasks, they must actively request activation of the role for a limited time (e.g., 2 hours). PIM can force them to provide a business justification, pass a Phishing-Resistant MFA prompt, and await approval from a manager before the privileges are temporarily granted.

This guide explains how to deploy PIM specifically for Azure Resources (Subscriptions and Resource Groups), securing the infrastructure data plane.

Understanding PIM Architecture for Azure Resources

PIM can manage two entirely separate permission boundaries in Microsoft’s ecosystem:

1. Entra ID Roles: Managing tenant-level permissions (e.g., Global Administrator, Exchange Administrator).
2. Azure Resource Roles: Managing infrastructure (e.g., Owner, Contributor, or Virtual Machine Contributor on a specific Azure Subscription).

This guide focuses on the latter. Because Azure Resources utilize Azure Role-Based Access Control (RBAC), PIM integrates directly into the Azure control plane. When a user activates an eligible role via PIM, the PIM service dynamically injects an Azure RBAC assignment that is programmed to self-destruct after the requested time limit expires.

Step 1: Discovering Azure Resources in PIM

Before you can apply PIM policies to an Azure Subscription, you must onboard that subscription into the PIM management engine.

1. Sign in to the Microsoft Entra admin center (entra.microsoft.com) as a Privileged Role Administrator.
2. Navigate to Identity Governance > Privileged Identity Management.
3. Under the Manage section, click on Azure resources.
4. If you do not see your Azure Subscriptions listed, click Discover resources.
5. Select the Subscriptions you wish to manage and click Manage resource. (You must be an Owner on the Azure Subscription to perform this initial onboarding).

Step 2: Configuring the Role Settings (The Policy)

Once the subscription is managed, you must define the security policy for the roles. We will configure the highly sensitive Owner role.

1. In the PIM console, click on your managed Azure Subscription.
2. Under Manage, click Settings.
3. Select the Owner role from the list.
4. Click Edit.

You will now configure the Activation rules:

• Maximum duration (hours): Set this to 2 hours. This ensures the permissions disappear rapidly.
• On activation, require: Select Microsoft Entra Conditional Access authentication context. This allows you to force a specific MFA strength (like FIDO2 keys) during activation.
• Require justification on activation: Check this box (Yes).
• Require approval to activate: Check this box (Yes) and select a group of senior architects who must manually approve the elevation request.

Click Update to save the policy.

Step 3: Assigning Eligible Access

Now that the policy is defined, you must strip the permanent Owner permissions from your IT staff and assign them as Eligible instead.

First, go to the standard Azure Portal (portal.azure.com), navigate to the Subscription, open Access control (IAM), and remove the permanent Owner assignments for your administrators.

Next, return to the PIM console for that Subscription:

1. Under Manage, click Roles.
2. Click Add assignments.
3. Select role: Choose Owner.
4. Select member(s): Select the Entra ID group containing your cloud engineers.
5. Click Next.
6. Assignment type: Select Eligible (Do not select Active, as that defeats the purpose of PIM).
7. Assignment duration: You can assign this eligibility permanently, or set it to expire after a year.
8. Click Assign.

Step 4: The End-User Activation Workflow

When an engineer needs to modify the network peering in the Subscription, they will log into Azure and find they have read-only (or zero) access.

To gain access, they must initiate the PIM workflow:

1. The engineer navigates to Privileged Identity Management > My roles > Azure resources.
2. They locate the Owner role for the target Subscription and click Activate.
3. Because of our policy in Step 2, PIM forces them to insert their FIDO2 security key to satisfy the authentication context.
4. They enter a justification: “Ticket INC-4928: Reconfiguring VNet peering for production outage.”
5. They click Activate.

The request enters a Pending approval state. The designated approvers receive an email. Once an approver reviews the ticket and clicks Approve, the Azure RBAC engine grants the Owner role. Exactly two hours later, the role is automatically revoked, returning the environment to a state of zero standing privileges.

Conclusion

Standing privileges are the primary vector for catastrophic cloud breaches. By configuring Microsoft Entra ID Privileged Identity Management for Azure Resources, security teams construct an impenetrable, time-bound barrier around infrastructure management. Combining PIM with strict approval workflows and cryptographic authentication ensures that extreme privileges exist only exactly when, and exactly for how long, they are legitimately required.