Just-in-Time Admin Access with Privileged Identity Management

Lab Metadata

Core technologies

Scenario and Description

Your Lab 01 baseline listed Northgate's privileged role holders. Every one of them holds their admin role permanently, active every second of every day, whether they are performing an admin task or asleep. That is standing privilege, and it is the single largest movement in an attacker's favour: compromise any one of those accounts at any time and you inherit live admin rights immediately.

Privileged Identity Management (PIM) breaks this model. Instead of being permanently active in a role, an administrator is made eligible for it. When they need it, they activate the role for a bounded window, providing a justification, passing MFA, and, for the most sensitive roles, waiting for approval. When the window expires, the privilege evaporates. The account spends almost all of its life with no admin rights at all, so a stolen credential is worth far less.

This is the heart of the brief's requirement to "support the deployment and optimisation of Privileged Access Management" and to "implement least-privilege access principles". You will inventory standing privilege, tune the role activation policy, convert an administrator from permanently active to eligible, activate just-in-time as that user, and, crucially, keep your break-glass accounts as a deliberate exception so an emergency is never blocked by an activation workflow.

Prerequisites

Prior labs

Labs 01 and 03 required. You use the jpatel administrator from Lab 01 and the break-glass accounts from Lab 03. PIM requires Entra ID P2, which your Lab 01 trial provides.

Graph scopes introduced

Real-World Problem Statement

Least privilege is not only about which roles someone has, it is about when they have them. A role held permanently is a role available to an attacker permanently. Reducing the time privilege is active is often a bigger risk reduction than reducing the number of people who hold it.

Concrete scenario: Northgate has 14 permanent administrators across sensitive roles. The CISO wants none of them permanently active by quarter end. Every elevation must require MFA and a justification, Global Administrator activations must require approval, and break-glass must remain instantly usable outside the whole workflow.

Skills Mapped to Production Solutions

Architecture Overview

PIM introduces two states for a role: eligible (you may activate it) and active (you currently hold it). Administrators live in the eligible state and activate briefly on demand. Break-glass accounts stay permanently active, outside the workflow.

Step-by-Step Implementation

Phase A - Inventory standing privilege

Connect-MgGraph -Scopes 'RoleManagement.ReadWrite.Directory',
  'RoleManagementPolicy.ReadWrite.Directory','Directory.Read.All' -NoWelcome

# Active (currently effective) directory role assignments.
$assignments = Get-MgRoleManagementDirectoryRoleAssignment -All -ExpandProperty Principal

$assignments | ForEach-Object {
  $roleDef = Get-MgRoleManagementDirectoryRoleDefinition -UnifiedRoleDefinitionId $_.RoleDefinitionId
  [pscustomobject]@{
    Role      = $roleDef.DisplayName
    Principal = $_.Principal.AdditionalProperties['userPrincipalName']
    Type      = ($_.Principal.AdditionalProperties['@odata.type'] -replace '#microsoft.graph.','')
    AssignmentId = $_.Id
  }
} | Sort-Object Role | Format-Table -AutoSize

Phase B - Tune the activation policy

# PORTAL: entra.microsoft.com > ID Governance > Privileged Identity Management >
#   Microsoft Entra roles > Settings > select 'User Administrator' > Edit.
#
# Activation:
#   Maximum activation duration = 8 hours
#   Require multi-factor authentication on activation = Yes
#   Require justification on activation = Yes
#   Require approval to activate = No (for User Administrator)
#
# For 'Global Administrator', repeat with:
#   Require approval to activate = Yes, and name specific approvers.
#   Require phishing-resistant MFA (ties to Lab 04) if configured.
#
# READ BACK via Graph to confirm the policy exists for the role scope:
$polAssign = Get-MgPolicyRoleManagementPolicyAssignment `
  -Filter "scopeId eq '/' and scopeType eq 'DirectoryRole' and roleDefinitionId eq 'fe930be7-5e62-47db-91af-98c3a49a38b1'"
Get-MgPolicyRoleManagementPolicyRule -UnifiedRoleManagementPolicyId $polAssign.PolicyId |
  Select-Object Id, AdditionalProperties

Phase C - Make jpatel eligible, then remove standing access

$domain  = (Get-MgOrganization).VerifiedDomains | Where-Object IsDefault | Select-Object -ExpandProperty Name
$jpatel  = Get-MgUser -Filter "userPrincipalName eq 'jpatel@$domain'"
$roleDefId = 'fe930be7-5e62-47db-91af-98c3a49a38b1'   # User Administrator

New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
  action           = 'adminAssign'
  principalId      = $jpatel.Id
  roleDefinitionId = $roleDefId
  directoryScopeId = '/'
  justification    = 'Move jpatel to eligible JIT for User Administrator'
  scheduleInfo = @{
    startDateTime = (Get-Date).ToString('o')
    expiration    = @{ type = 'noExpiration' }   # eligibility persists; recertified via access reviews (Lab 08)
  }
}

Get-MgRoleManagementDirectoryRoleEligibilitySchedule `
  -Filter "principalId eq '$($jpatel.Id)'" |
  Select-Object RoleDefinitionId, Status, MemberType
# Expected: an eligibility schedule for the User Administrator role.

# Find jpatel's permanent active User Administrator assignment.
$perm = Get-MgRoleManagementDirectoryRoleAssignment -All `
  -Filter "principalId eq '$($jpatel.Id)' and roleDefinitionId eq '$roleDefId'"

# Remove it. jpatel now holds the role only when activated.
if ($perm) {
  Remove-MgRoleManagementDirectoryRoleAssignment -UnifiedRoleAssignmentId $perm.Id
  Write-Host 'Permanent User Administrator assignment removed for jpatel.' -ForegroundColor Green
}

Phase D - Activate just-in-time

# PORTAL (as jpatel): entra.microsoft.com > PIM > My roles >
#   Microsoft Entra roles > Eligible assignments > User Administrator > Activate.
#   Provide a justification, complete MFA, choose a duration up to 8 hours.
#
# GRAPH (signed in as jpatel):
$me = Get-MgUser -UserId (Get-MgContext).Account
New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest -BodyParameter @{
  action           = 'selfActivate'
  principalId      = $me.Id
  roleDefinitionId = 'fe930be7-5e62-47db-91af-98c3a49a38b1'
  directoryScopeId = '/'
  justification    = 'Onboarding three new joiners this afternoon'
  scheduleInfo = @{
    startDateTime = (Get-Date).ToString('o')
    expiration    = @{ type = 'afterDuration'; duration = 'PT8H' }   # 8-hour window
  }
}

# As an admin, confirm the active (activated) instance and its expiry:
Get-MgRoleManagementDirectoryRoleAssignmentScheduleInstance `
  -Filter "principalId eq '$($jpatel.Id)'" |
  Select-Object RoleDefinitionId, StartDateTime, EndDateTime, AssignmentType
# AssignmentType 'Activated' with an EndDateTime ~8 hours out.

Phase E - Protect the break-glass exception

foreach ($n in 1..2) {
  $bg = Get-MgUser -Filter "userPrincipalName eq 'breakglass$n@$domain'"
  $a = Get-MgRoleManagementDirectoryRoleAssignment -All -Filter "principalId eq '$($bg.Id)'"
  [pscustomobject]@{
    Account = $bg.UserPrincipalName
    HasPermanentRole = [bool]$a
  }
} | Format-Table -AutoSize
# Expected: HasPermanentRole = True for both break-glass accounts.

Testing and Validation

1. Eligibility: confirm jpatel appears under eligible assignments and holds no active User Administrator rights when not activated.
2. Activation: as jpatel, activate the role with a justification and MFA, then confirm an active instance exists with an expiry.
3. Expiry: after the window (or by ending the activation early), confirm the active instance is gone and rights are removed.
4. Approval (Global Admin): configure approval on Global Administrator, request activation, and confirm it waits for approver action.
5. Break-glass: confirm both emergency accounts still hold permanent Global Administrator outside PIM.

Security Analysis

What makes this sound

• Minimised standing privilege: admins are eligible, not active, so a stolen credential is rarely privileged at the moment of theft.
• Gated elevation: MFA, justification and, for top roles, approval, ensure every activation is accountable.
• Automatic expiry: time-bound activation removes the risk of forgotten standing rights.
• Preserved recovery: break-glass stays outside PIM so emergencies are never blocked.

Intentionally simplified for the lab

• Policy tuning is done in the portal. Production teams often manage these policies as code, which is more involved via Graph.
• A single role is converted. Real rollouts convert every privileged role and use PIM for groups too.

Production hardening

• Require phishing-resistant MFA (Lab 04) on activation of the most sensitive roles.
• Alert on every Global Administrator activation and on any new permanent role assignment, which should now be rare.
• Recertify eligibility with access reviews (Lab 08) so eligible does not quietly become forever.

Cleanup Instructions

$domain = (Get-MgOrganization).VerifiedDomains | Where-Object IsDefault | Select-Object -ExpandProperty Name
$jpatel = Get-MgUser -Filter "userPrincipalName eq 'jpatel@$domain'"
$roleDefId = 'fe930be7-5e62-47db-91af-98c3a49a38b1'

# Recreate a permanent active assignment if you want jpatel back to standing admin.
New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest -BodyParameter @{
  action='adminAssign'; principalId=$jpatel.Id; roleDefinitionId=$roleDefId; directoryScopeId='/'
  justification='reset'; scheduleInfo=@{ startDateTime=(Get-Date).ToString('o'); expiration=@{ type='noExpiration' } } }

# Remove the eligibility.
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
  action='adminRemove'; principalId=$jpatel.Id; roleDefinitionId=$roleDefId; directoryScopeId='/'
  justification='reset' }
Disconnect-MgGraph

Recommended Learning Links

• Privileged Identity Management overview
• Configure Entra role activation settings
• Graph API: PIM for Entra roles
• Emergency access accounts and PIM
• Assign eligible and active roles

Key Takeaways and Next Lab

• Least privilege includes time: standing admin rights are always-on risk, eligibility plus activation removes it.
• Gate activation with MFA, justification and, for the highest roles, approval, and bound it in time.
• Make people eligible before removing standing access, availability before removal.
• Break-glass accounts stay permanently active and outside PIM by design.