PIM for Azure Resources

PIM for Azure Resources: Complete Guide for SC-300

Privileged Identity Management (PIM) for Azure Resources

Why Is PIM for Azure Resources Important?

In modern cloud environments, managing privileged access to Azure resources is one of the most critical aspects of security governance. Azure resources such as subscriptions, resource groups, virtual machines, storage accounts, and databases often contain sensitive data and configurations. If a malicious actor gains permanent privileged access to these resources, the potential for damage is enormous — from data exfiltration to complete infrastructure destruction.

PIM for Azure Resources addresses this challenge by implementing the principle of least privilege and just-in-time (JIT) access. Instead of granting users permanent elevated roles on Azure resources, PIM enables organizations to provide time-bound, approval-based, and auditable access. This dramatically reduces the attack surface and ensures that privileged access is only available when genuinely needed.

Key reasons PIM for Azure Resources is important:
- Reduces standing privileged access to Azure infrastructure
- Enforces just-in-time access for Azure resource roles
- Provides full audit trails for compliance and security investigations
- Supports approval workflows for sensitive resource access
- Enables access reviews to periodically validate role assignments
- Helps organizations meet regulatory requirements (SOC 2, ISO 27001, NIST, etc.)

---

What Is PIM for Azure Resources?

PIM for Azure Resources is a feature within Microsoft Entra Privileged Identity Management that extends PIM capabilities beyond Microsoft Entra (Azure AD) directory roles to Azure RBAC (Role-Based Access Control) roles at any scope — management groups, subscriptions, resource groups, and individual resources.

While PIM for Microsoft Entra roles manages directory-level roles like Global Administrator or User Administrator, PIM for Azure Resources manages roles such as:

- Owner — Full control over Azure resources, including the ability to assign roles
- Contributor — Can create and manage resources but cannot assign roles
- Reader — View-only access to resources
- User Access Administrator — Can manage user access to Azure resources
- Custom RBAC roles — Any custom role defined at a given scope

PIM for Azure Resources allows you to make these role assignments eligible rather than active, meaning users must explicitly activate their role when they need it.

Key Concepts:

Eligible Assignment: The user is assigned a role but it is not active. They must perform an activation to use the role. This is the core concept of JIT access.

Active Assignment: The user has the role assigned and active without needing to perform any activation. This can still be time-bound through PIM.

Activation: The process by which an eligible user requests to use their role. This may require justification, MFA, or approval.

Assignment Duration: Both eligible and active assignments can be configured as permanent or time-bound (with start and end dates).

Scope: PIM for Azure Resources operates at the Azure RBAC scope hierarchy — management group > subscription > resource group > resource.

---

How Does PIM for Azure Resources Work?

1. Discovery and Onboarding
Before you can manage Azure resources with PIM, the resources must be discovered and onboarded. A user with Owner or User Access Administrator role at the subscription or management group level can onboard resources into PIM. Once onboarded, all RBAC roles at that scope become manageable through PIM.

2. Configuring Role Settings
For each Azure resource role, administrators can configure role settings that define the governance policies:

- Maximum activation duration: How long a user can keep the role active (e.g., 1 hour, 8 hours, up to 24 hours)
- Require MFA on activation: Whether multi-factor authentication is required when activating the role
- Require justification: Whether users must provide a business justification for activation
- Require approval: Whether one or more designated approvers must approve the activation request
- Require ticket information: Whether users must provide a ticket number from an ITSM system
- Notification settings: Configure email notifications for assignments, activations, and approvals
- Eligible assignment duration: Whether eligible assignments are permanent or have an expiration
- Active assignment duration: Whether active assignments are permanent or time-bound

3. Making Role Assignments
Administrators assign users, groups, or service principals to Azure resource roles as either eligible or active:

- Eligible assignments require the user to activate the role before using it
- Active assignments are immediately effective but can be time-bound
- Assignments can target specific scopes (a single resource, resource group, subscription, or management group)

4. Activation Workflow
When an eligible user needs access, they follow the activation workflow:

Step 1: The user navigates to PIM in the Azure portal or Microsoft Entra admin center
Step 2: They select My roles > Azure resources
Step 3: They choose the eligible role and click Activate
Step 4: They specify the activation duration (within the maximum allowed)
Step 5: They provide justification and/or ticket information if required
Step 6: They complete MFA if required
Step 7: If approval is required, the request goes to designated approvers
Step 8: Once approved (or auto-approved), the role becomes active for the specified duration
Step 9: The role automatically deactivates when the duration expires

5. Approval Process
When approval is configured:
- Designated approvers receive email notifications about pending requests
- Approvers can approve or deny requests from the PIM interface
- They can see the justification provided by the requestor
- If no approver responds within the configured timeout, the request is denied

6. Access Reviews
PIM for Azure Resources supports access reviews to periodically validate that role assignments are still needed:
- Administrators can create recurring access reviews for Azure resource roles
- Reviewers (self-review, managers, or specific reviewers) assess whether each assignment is still justified
- Results can automatically remove access for users who don't respond or are denied

7. Alerts and Monitoring
PIM provides built-in security alerts for Azure resources:
- Too many owners assigned to a resource
- Roles are being assigned outside of PIM
- Roles don't require MFA for activation
- Redundant eligible role assignments
- Potential stale role assignments

All PIM activities are logged in the Microsoft Entra audit log and can be exported to Azure Monitor, SIEM solutions, or Log Analytics for long-term retention and analysis.

---

PIM for Azure Resources vs. PIM for Microsoft Entra Roles

Understanding the distinction is critical for the exam:

PIM for Microsoft Entra Roles:
- Manages directory-level roles (Global Admin, User Admin, etc.)
- Scope is the Microsoft Entra tenant
- Roles defined in Microsoft Entra ID

PIM for Azure Resources:
- Manages Azure RBAC roles (Owner, Contributor, Reader, custom roles, etc.)
- Scope can be management group, subscription, resource group, or individual resource
- Roles defined in Azure RBAC
- Requires resource discovery/onboarding

---

Licensing Requirements

PIM for Azure Resources requires Microsoft Entra ID P2 (or Microsoft Entra ID Governance) licenses for users who are:
- Eligible for or assigned to Azure resource roles through PIM
- Approving or denying activation requests
- Participating in access reviews

---

Prerequisites and Required Roles

To manage PIM for Azure Resources, you need:
- Owner or User Access Administrator role at the appropriate Azure scope to onboard resources and manage assignments
- Privileged Role Administrator in Microsoft Entra for configuring PIM settings
- Microsoft Entra ID P2 license

---

Exam Tips: Answering Questions on PIM for Azure Resources

Tip 1: Know the Scope Hierarchy
PIM for Azure Resources follows the Azure RBAC scope hierarchy: Management Group > Subscription > Resource Group > Resource. Settings and assignments at a higher scope can be inherited by lower scopes. Exam questions may test whether you understand that an eligible Owner assignment at the subscription level provides potential access to all resource groups and resources within that subscription upon activation.

Tip 2: Distinguish Between Eligible and Active Assignments
This is a very common exam topic. Eligible means the user CAN activate the role when needed. Active means the role is already in effect. If a question asks about implementing just-in-time access, the answer involves eligible assignments, not active ones.

Tip 3: Understand the Activation Settings
Know the configurable settings for activation: maximum duration (up to 24 hours), MFA requirement, justification requirement, approval requirement, and ticket information. If a question describes a scenario requiring manager approval before a user can access a production subscription, you need to configure the approval setting with the manager as an approver.

Tip 4: Remember That PIM for Azure Resources Is Separate from PIM for Entra Roles
If a question mentions roles like Owner, Contributor, Reader, or custom Azure RBAC roles, you are dealing with PIM for Azure Resources. If it mentions Global Administrator, User Administrator, or other directory roles, that is PIM for Microsoft Entra roles. The navigation paths in the portal are different.

Tip 5: Know the Licensing
PIM requires Microsoft Entra ID P2. If a question mentions an organization with only Microsoft Entra ID Free or P1, PIM is not available. This is a common distractor in exam questions.

Tip 6: Access Reviews for Compliance
When a question describes a scenario where an organization needs to periodically verify that Azure resource role assignments are still appropriate, the answer is to configure access reviews for Azure resource roles in PIM. Know that access reviews can be configured with auto-apply results to automatically remove access.

Tip 7: Alerts and Security Hygiene
PIM generates alerts when security best practices are not followed. If a question asks how to identify excessive permanent Owner assignments on a subscription, the answer relates to PIM alerts or the PIM dashboard for Azure resources.

Tip 8: Groups and PIM
PIM supports assigning groups as eligible for Azure resource roles. This is often tested — if a scenario asks about managing PIM at scale for multiple users, assigning a group as eligible is the recommended approach. Note that these should be role-assignable groups.

Tip 9: Service Principals and Managed Identities
PIM for Azure Resources can make service principals eligible for roles, but service principals cannot self-activate. An administrator must activate the role on their behalf. This is a subtle detail that may appear in exam questions.

Tip 10: Read Scenarios Carefully
Many exam questions present multi-step scenarios. Look for keywords like:
- "just-in-time" → eligible assignment in PIM
- "require approval" → approval workflow in role settings
- "time-limited" → time-bound activation or assignment duration
- "audit" or "compliance" → PIM audit logs or access reviews
- "minimize standing access" → PIM eligible assignments
- "Azure subscription Owner" → PIM for Azure Resources (not Entra roles)

Tip 11: Know the End-to-End Process
Be prepared to order steps or select the correct sequence: Onboard resource → Configure role settings → Create eligible assignment → User activates role → (Optional) Approver approves → User has temporary access → Access auto-expires.

Tip 12: Integration with Conditional Access
PIM activation can leverage Conditional Access authentication context. If a question mentions requiring a specific Conditional Access policy when activating a privileged Azure role, this is the feature being referenced. This is a newer capability and increasingly relevant for the SC-300 exam.

Summary for Exam Success:
PIM for Azure Resources is about bringing just-in-time, approval-based, time-limited, auditable privileged access to Azure RBAC roles. Always think about reducing permanent access, enforcing governance controls, and maintaining visibility. When you see an exam question about managing privileged access to Azure subscriptions, resource groups, or resources — PIM for Azure Resources is your answer.