LAB 18: Privileged Identity Management (PIM)

Navigate to: entra.microsoft.com → Identity governance → Privileged Identity Management Or directly: https://entra.microsoft.com/#view/Microsoft_Azure_PIMCommon/CommonMenuBlade/~/quickStart Prerequisites: - Microsoft Entra ID P2 license (or EMS E5) - Privileged Role Administrator or Global Administrator Initial View: → Entra ID roles → Roles - Lists all Entra ID built-in roles - Shows current assignments (Eligible vs Active) - Indicates if role is being managed by PIM High-Priority Roles for PIM: ├── Global Administrator (CRITICAL) ├── Privileged Role Administrator (CRITICAL) ├── Privileged Authentication Administrator (CRITICAL) ├── Security Administrator (HIGH) ├── User Administrator (HIGH) ├── Exchange Administrator (HIGH) ├── SharePoint Administrator (MEDIUM) └── Application Administrator (MEDIUM)

Navigate to: PIM → Entra ID roles → Settings → Select role (e.g., Global Administrator) → Edit ACTIVATION TAB: Activation maximum duration: - Default: 8 hours - Recommended for Global Admin: 2 hours - For less critical roles: 4-8 hours On activation, require: ☑️ Azure MFA (ALWAYS enable) ☑️ Justification (ALWAYS enable) ☑️ Ticket information (Recommended for audit) Require approval to activate: ☑️ Yes (for critical roles) → Select approvers: Security team, PAM admins Require Conditional Access authentication context: - Optional: Require specific auth context - Example: Require phishing-resistant MFA --- ASSIGNMENT TAB: Allow permanent eligible assignment: ☐ No (Recommended - force expiration) Expire eligible assignments after: - 90 days (Recommended) - 180 days (Less restrictive) Allow permanent active assignment: ☐ No (Strongly recommended) Expire active assignments after: - 30 days maximum - 0 = disabled (no permanent active) Require MFA on active assignment: ☑️ Yes Require justification on active assignment: ☑️ Yes

Navigate to: PIM → Entra ID roles → Roles → Select role (e.g., Global Administrator) → Add assignments MEMBERSHIP TAB: - Assignment type: Eligible (NOT Active!) - Select members: Choose users/groups SETTING TAB: - Assignment starts: Now (or future date) - Assignment ends: ○ Permanently eligible (if allowed in settings) ● Time bound: Set end date (e.g., 90 days) → Assign Result: - User now has ELIGIBLE assignment - User does NOT have the role active - User must ACTIVATE to use privileges Best Practice: Assign to Groups, not individuals - Create security group: "PIM-GlobalAdmins-Eligible" - Assign group as eligible - Add/remove users from group - Easier management at scale

User Activation Steps: Navigate to: PIM → My roles → Entra ID roles 1. Find Eligible Role: - See list of roles you're eligible for - Status: "Eligible" 2. Click "Activate": → Activation page opens 3. Set Duration: - Choose activation duration (up to max allowed) - Example: 2 hours 4. Provide Justification: - "Investigating security incident INC0012345" - "Performing quarterly access review" - Be specific—this is audited! 5. Provide Ticket (if required): - Ticket system: ServiceNow - Ticket number: INC0012345 6. Complete MFA: - MFA challenge appears - Complete authentication 7. Wait for Approval (if required): - Request submitted - Approvers notified via email - User notified when approved/denied 8. Role Active: - Status changes to "Active" - Duration countdown begins - User now has role permissions 9. Automatic Deactivation: - Role expires after duration - No action needed - Or manually deactivate early

View Activation History: Navigate to: PIM → Entra ID roles → My audit history (for self) Or: PIM → Entra ID roles → Resource audit (for all) Audit Log Fields: - Time: When activation occurred - User: Who activated - Role: Which role - Action: Add member to role (activated) - Reason: Justification provided - Ticket: Ticket information Filter Options: - Date range - User - Role - Action type Export: - Download CSV for compliance reporting - Integrate with SIEM via Log Analytics Key Audit Events: ├── Add member to role in PIM completed (activation) ├── Remove member from role in PIM completed (deactivation) ├── Add eligible member to role in PIM completed (assignment) ├── PIM activation request approved ├── PIM activation request denied └── Role setting updated in PIM

Navigate to: PIM → Azure resources First-Time Setup: → Discover resources - PIM scans your Azure subscriptions - Shows management groups, subscriptions, resource groups Resource Hierarchy: Management Group (Tenant Root Group) ├── Management Group (Production) │ ├── Subscription (Prod-East) │ │ ├── Resource Group (rg-web) │ │ └── Resource Group (rg-database) │ └── Subscription (Prod-West) ├── Management Group (Non-Production) │ ├── Subscription (Development) │ └── Subscription (Staging) └── Subscription (Sandbox) PIM can manage at ANY level: - Management Group: Inherits to all below - Subscription: Inherits to resource groups - Resource Group: Inherits to resources - Individual Resource: Most granular Recommendation: - Start with subscription level - Use resource group for team-specific access

Navigate to: PIM → Azure resources → Select subscription → Settings → Select role (e.g., Owner, Contributor) → Edit Owner Role Settings (Critical): - Max activation: 2 hours - Require MFA: Yes - Require justification: Yes - Require approval: Yes - Approvers: Cloud Platform team Contributor Role Settings (High): - Max activation: 4 hours - Require MFA: Yes - Require justification: Yes - Require approval: No (or Yes for Prod) Reader Role Settings (Low): - Max activation: 8 hours - Require MFA: Yes - Require justification: Yes - Require approval: No Custom Roles: - Same configuration available - Set based on permissions granted Different Settings per Scope: - Production subscription: Stricter - Development subscription: Relaxed - Configure separately for each

Navigate to: PIM → Azure resources → Select subscription → Assignments → Add assignments Role Selection: - Owner - Contributor - Reader - User Access Administrator - Custom roles Scope: - This subscription (selected) - Or drill down to resource group/resource Members: - Select users or groups - Prefer groups for easier management Assignment Type: ● Eligible (Recommended) ○ Active (Only if absolutely necessary) Duration: - Start: Immediately or scheduled - End: Time-bound recommended (90-180 days) → Assign User Activation: Same process as Entra ID roles: PIM → My roles → Azure resources → Activate

Enterprise Pattern: PIM at Management Group Level Benefits: - Single assignment covers multiple subscriptions - Consistent policy across environment - Easier to manage at scale Setup: Navigate to: PIM → Azure resources → Select Management Group → Configure settings and assignments Example Structure: Tenant Root Group ├── PIM for: Global Cloud Admins (Owner, eligible) │ ├── MG-Production │ ├── PIM for: Prod Admins (Owner, eligible, approval required) │ └── Subscriptions inherit settings │ ├── MG-NonProduction │ ├── PIM for: Dev Team (Contributor, eligible, no approval) │ └── Subscriptions inherit settings │ └── MG-Sandbox └── PIM for: All Engineers (Contributor, eligible) Important: Higher scope = broader access - Be careful with Management Group assignments - Use subscription/RG for team-specific access

Navigate to: Entra ID → Groups → New group Create Role-Assignable Group: - Group type: Security - Group name: PIM-CloudAdmins - Group description: Cloud administrators with JIT access - Microsoft Entra roles can be assigned: YES ⚠️ (This cannot be changed after creation!) - Membership type: Assigned - Owners: Security team - Members: (Leave empty - will manage via PIM) → Create Why Role-Assignable Groups? - Groups can be assigned to Entra ID roles - Groups can be managed via PIM - Members get JIT access to group membership - Group membership = Role membership (indirect) Use Cases: 1. AWS SSO: Group → AWS Permission Set 2. App access: Group → Enterprise App assignment 3. Entra roles: Group → Global Admin role 4. Azure RBAC: Group → Subscription Owner

Navigate to: PIM → Groups → Discover groups (if first time) → Select your role-assignable group Two PIM Assignment Types for Groups: 1. MEMBER (Most common) - User becomes member of group when activated - Gets all permissions associated with group - Use for: Access control scenarios 2. OWNER - User becomes owner of group when activated - Can manage group membership - Use for: Delegated group management Configure Settings: → Settings → Member → Edit Member Settings: - Max activation: 4 hours - Require MFA: Yes - Require justification: Yes - Require approval: (based on what group provides) → Settings → Owner → Edit Owner Settings: - Max activation: 2 hours (more restrictive) - Require approval: Yes

Navigate to: PIM → Groups → Select group → Assignments → Add assignments Assignment Details: - Select role: Member - Select members: Choose users Assignment Type: ● Eligible (Users must activate) ○ Active (Immediate, use sparingly) Duration: - Start: Now - End: 180 days (or permanent if allowed) → Assign Verify: - Users now see group in: My roles → Groups - Users can activate membership when needed Power Pattern: Nested PIM Scenario: User needs Global Admin - Instead of: User eligible for Global Admin directly - Use: User eligible for "PIM-GlobalAdmins" group - Group is assigned to Global Admin role Benefits: - Manage who can request via group membership - Access reviews on group (not role) - Single point of control

Enterprise Group Strategy: Tier 0 (Control Plane): ├── PIM-Tier0-IdentityAdmins │ └── Assigned to: Global Admin, Priv Role Admin │ └── Approval: Security Leadership │ └── Max duration: 2 hours │ ├── PIM-Tier0-SecurityAdmins │ └── Assigned to: Security Admin, Security Reader │ └── Approval: SOC Manager │ └── Max duration: 4 hours Tier 1 (Management Plane): ├── PIM-Tier1-UserAdmins │ └── Assigned to: User Administrator │ └── Approval: IT Manager │ ├── PIM-Tier1-ExchangeAdmins │ └── Assigned to: Exchange Administrator │ └── Approval: Messaging Team Lead Tier 2 (Workload Plane): ├── PIM-Tier2-HelpdeskOps │ └── Assigned to: Helpdesk Administrator │ └── No approval required │ ├── PIM-Tier2-ReportReaders │ └── Assigned to: Reports Reader │ └── No approval required Benefits: - Clear tiering model - Different approval chains - Easier access reviews - Scalable management

Navigate to: PIM → Entra ID roles → Settings → Select role → Edit → Activation tab Enable Approval: ☑️ Require approval to activate Select Approvers: → Select approver(s) Approver Types: 1. Specific Users - Individual users as approvers - At least 2 recommended for redundancy 2. Groups - Security group as approvers - Any member can approve - Recommended for team-based approval 3. No Approvers Selected - Role Owner becomes default approver - For Entra roles: Privileged Role Admin Approver Best Practices: - Always have 2+ approvers - Use groups for vacation coverage - Approvers should NOT be requesters - Different approvers for different roles Example Approver Matrix: | Role | Approvers | |--------------------|------------------------------| | Global Admin | CISO, Security Director | | Security Admin | SOC Manager, Security Team | | User Admin | IT Director, IAM Team | | Exchange Admin | Messaging Lead, IT Manager |

Approver Experience: 1. Notification: - Email sent to approvers - Subject: "PIM: Approval needed for [User] to [Role]" - Contains: Requestor, Role, Justification, Duration 2. Access Pending Requests: Navigate to: PIM → Approve requests Or: Click link in email 3. Review Request Details: - Who is requesting - Which role - Duration requested - Justification provided - Ticket information - Request time 4. Take Action: → Approve: Grant activation → Deny: Reject with reason 5. Add Comments (Required for Deny): - "Approved - valid business need" - "Denied - no valid ticket number" - "Denied - contact manager first" Timeout: - Requests expire after 24 hours by default - Configurable in settings - Expired = Denied automatically Mobile Approval: - Approvers can use Authenticator app - Push notification for quick approval

Multi-Stage Approval (Currently in Preview): Scenario: Global Admin requires two levels of approval Stage 1: Direct Manager - Manager reviews business need - Approves if valid request Stage 2: Security Team - Security reviews risk - Final approval gate Configuration: Navigate to: Role Settings → Edit → Enable multi-stage approval (if available) → Configure Stage 1 approvers → Configure Stage 2 approvers Alternative: Access Packages If multi-stage not available, use Entitlement Management: 1. Create Access Package containing: - PIM-eligible group membership 2. Configure multi-stage approval: - Stage 1: Manager approval - Stage 2: Resource owner approval 3. User requests via My Access portal 4. After both approvals: - User added to PIM-eligible group - User can then activate role

Notification Settings: Navigate to: Role Settings → Notifications tab NOTIFICATION TYPES: When members are assigned as eligible: - Send notification to: Admins, Requestor - Email: Assignment notification When members are assigned as active: - Send notification to: Admins, Requestor - Alert on permanent active When eligible members activate: - Send notification to: Admins - Useful for monitoring When PIM activation requires approval: - Send notification to: Approvers - Critical for timely response ESCALATION STRATEGY: Since PIM doesn't have built-in escalation: Option 1: Group Approvers - Add multiple people to approver group - Any member can approve - No single point of failure Option 2: Logic App Integration - Monitor pending requests via Graph API - If pending > X hours, send escalation - Page on-call approver Option 3: Short Timeout + Re-request - Set 4-hour timeout - If denied/expired, user re-requests - Different approver may see it

Navigate to: PIM → Entra ID roles → Access reviews → New access review REVIEW SCOPE: Select role(s) to review: ☑️ Global Administrator ☑️ Privileged Role Administrator ☑️ Security Administrator (Select multiple for efficiency) Review scope: ● Assigned users only ○ All users (includes eligible) Inactive users (preview): ☑️ Include inactive users only - Users who haven't signed in X days - Great for cleanup reviews --- REVIEW TYPE: Reviewers: ○ Manager - Direct manager reviews ○ Self - Users review own access ● Selected user(s) or group(s) - Specific reviewers → Select: Security Team Review recurrence: - One time - Weekly - Monthly ● Quarterly (Recommended for privileged) - Semi-annually - Annually

UPON COMPLETION SETTINGS: Auto apply results: ☑️ Enable (Recommended for PIM) - Automatically remove access if denied - Reduces manual work If reviewers don't respond: ● No change ○ Remove access ○ Approve access ○ Take recommendations (Choose based on risk tolerance) --- ADVANCED SETTINGS: Show recommendations: ☑️ Yes - Based on sign-in activity - Last 30-day usage - Helps reviewers decide Require reason for approval: ☑️ Yes - Document why access retained - Audit trail Email notifications: ☑️ Notify reviewers when review starts ☑️ Send reminders to reviewers ☑️ Notify users of results Duration: - Review period: 14 days (sufficient time) - Start date: First of quarter --- → Start review

Reviewer Experience: 1. Notification: - Email: "Access review starting for Global Administrator" - Link to review portal 2. Access Review: Navigate to: myaccess.microsoft.com → Access reviews → Pending reviews Or: PIM → Access reviews → Review access 3. Review Each User: For each user, you see: - User name and email - Role assigned - Assignment type (Eligible/Active) - Last sign-in date - Recommendation (Approve/Deny based on activity) 4. Make Decision: ○ Approve - User keeps access ○ Deny - User loses access ○ Don't know - Skip (not recommended) 5. Provide Reason: - "Approved: Active member of security team" - "Denied: User transferred to different department" - "Denied: No activity in 90 days" 6. Submit Review: - Review each user - Submit when complete - Reminder emails if incomplete 7. Results Applied: - Auto-apply removes denied users - Users notified of decisions

Recommended Review Schedule: TIER 0 - Control Plane (Quarterly): ├── Global Administrator ├── Privileged Role Administrator ├── Privileged Authentication Administrator ├── Security Administrator └── Conditional Access Administrator TIER 1 - Management Plane (Semi-Annually): ├── User Administrator ├── Exchange Administrator ├── SharePoint Administrator ├── Teams Administrator └── Intune Administrator TIER 2 - Workload Plane (Annually): ├── Helpdesk Administrator ├── Reports Reader ├── Directory Readers └── Guest Inviter AZURE RESOURCES: Quarterly: ├── Subscription Owner ├── User Access Administrator └── Key Vault Administrator Semi-Annually: ├── Contributor └── Security Admin (Azure) Review Calendar Example: Q1 (Jan): Tier 0 + Azure Owners Q2 (Apr): Tier 1 + Azure Contributors Q3 (Jul): Tier 0 + Azure Owners (repeat) Q4 (Oct): Tier 2 + All Azure

Navigate to: PIM → Entra ID roles → Alerts Built-in Alerts: 1. Roles are being activated too frequently - Threshold: X activations in Y hours - Indicates: Possible misuse or misconfiguration - Action: Review activation patterns 2. Roles don't require MFA for activation - Critical security gap - Action: Enable MFA requirement immediately 3. Users have permanent admin role assignments - Standing privileges = risk - Action: Convert to eligible assignments 4. Potential stale accounts in privileged roles - Users haven't signed in - Action: Review and remove if unnecessary 5. Administrators aren't using their privileged roles - Roles assigned but never activated - Action: Remove unnecessary assignments 6. Roles are being assigned outside of PIM - Direct assignments bypass PIM controls - Action: Investigate and remediate Configure Alerts: → Click alert → Settings - Adjust thresholds - Configure notification recipients - Set severity levels

# Configure Diagnostic Settings for PIM logs Navigate to: Entra ID → Monitoring → Diagnostic settings → Add diagnostic setting Name: PIM-to-LogAnalytics Logs to export: ☑️ AuditLogs (includes PIM events) ☑️ SignInLogs ☑️ RiskyUsers ☑️ UserRiskEvents Destination: ☑️ Send to Log Analytics workspace → Select workspace # KQL Query: PIM Activations AuditLogs | where Category == "RoleManagement" | where OperationName == "Add member to role in PIM completed (permanent)" or OperationName == "Add member to role in PIM completed (timebound)" | extend UserPrincipalName = tostring(InitiatedBy.user.userPrincipalName) | extend RoleName = tostring(TargetResources[0].displayName) | project TimeGenerated, UserPrincipalName, RoleName, Result | order by TimeGenerated desc # KQL Query: Privileged Role Assignments AuditLogs | where Category == "RoleManagement" | where OperationName contains "PIM" | summarize count() by OperationName, bin(TimeGenerated, 1d) | render timechart

# Sentinel Analytics Rule: Suspicious PIM Activity # Rule 1: Global Admin Activation Outside Business Hours AuditLogs | where OperationName == "Add member to role in PIM completed (timebound)" | extend RoleName = tostring(TargetResources[0].displayName) | where RoleName == "Global Administrator" | extend Hour = hourofday(TimeGenerated) | where Hour < 6 or Hour > 20 // Outside 6 AM - 8 PM | extend User = tostring(InitiatedBy.user.userPrincipalName) | project TimeGenerated, User, RoleName, Hour # Rule 2: Multiple Role Activations by Same User AuditLogs | where OperationName contains "Add member to role in PIM completed" | extend User = tostring(InitiatedBy.user.userPrincipalName) | summarize RoleCount = dcount(tostring(TargetResources[0].displayName)), Roles = make_set(tostring(TargetResources[0].displayName)) by User, bin(TimeGenerated, 1h) | where RoleCount > 3 | project TimeGenerated, User, RoleCount, Roles # Rule 3: PIM Activation from New Location let UserLocations = SigninLogs | where TimeGenerated > ago(30d) | summarize KnownLocations = make_set(Location) by UserPrincipalName; SigninLogs | where AppDisplayName == "Azure Portal" or AppDisplayName == "Microsoft Azure" | join kind=leftouter UserLocations on UserPrincipalName | where Location !in (KnownLocations) | project TimeGenerated, UserPrincipalName, Location, KnownLocations

Built-in Reports: Navigate to: PIM → Entra ID roles Resource Audit: - All PIM activities - Filter by date, user, role - Export to CSV My Audit: - Your own activations - Personal activity history Role Assignments: - Current eligible assignments - Current active assignments - Expired assignments Role Settings Audit: - Changes to role configuration - Who changed settings - What was changed --- Compliance Report Template: Generate quarterly report including: 1. Total privileged users per role 2. Eligible vs Active breakdown 3. Activation frequency 4. Average activation duration 5. Access review completion rate 6. Accounts removed via review 7. Alert summary Export: → Download from PIM → Or query Log Analytics for custom report → Schedule via Power Automate to email stakeholders

# Microsoft Graph PIM Endpoints # Base URL https://graph.microsoft.com/v1.0/ # List role definitions GET /roleManagement/directory/roleDefinitions # List role assignments (all) GET /roleManagement/directory/roleAssignmentScheduleInstances # List eligible assignments GET /roleManagement/directory/roleEligibilityScheduleInstances # List pending activations GET /roleManagement/directory/roleAssignmentScheduleRequests ?$filter=status eq 'PendingApproval' # Create eligible assignment POST /roleManagement/directory/roleEligibilityScheduleRequests { "action": "adminAssign", "justification": "Assigning eligible role via API", "roleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", "directoryScopeId": "/", "principalId": "user-guid-here", "scheduleInfo": { "startDateTime": "2024-01-15T00:00:00Z", "expiration": { "type": "afterDuration", "duration": "P90D" } } } # Activate role (user context) POST /roleManagement/directory/roleAssignmentScheduleRequests { "action": "selfActivate", "justification": "Need admin access for security investigation", "roleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", "directoryScopeId": "/", "principalId": "my-user-guid", "scheduleInfo": { "startDateTime": "2024-01-15T10:00:00Z", "expiration": { "type": "afterDuration", "duration": "PT4H" } } }

# Install Microsoft Graph PowerShell Install-Module Microsoft.Graph -Scope CurrentUser # Connect with required scopes Connect-MgGraph -Scopes @( "RoleManagement.ReadWrite.Directory", "RoleAssignmentSchedule.ReadWrite.Directory", "RoleEligibilitySchedule.ReadWrite.Directory" ) # List all Global Admin eligible assignments $globalAdminRoleId = "62e90394-69f5-4237-9190-012177145e10" Get-MgRoleManagementDirectoryRoleEligibilityScheduleInstance -Filter "roleDefinitionId eq '$globalAdminRoleId'" | Select-Object PrincipalId, StartDateTime, EndDateTime # Create eligible assignment $params = @{ Action = "adminAssign" Justification = "New team member - eligible for Security Admin" RoleDefinitionId = "194ae4cb-b126-40b2-bd5b-6091b380977d" # Security Admin DirectoryScopeId = "/" PrincipalId = "user-guid-here" ScheduleInfo = @{ StartDateTime = (Get-Date).ToUniversalTime() Expiration = @{ Type = "afterDuration" Duration = "P180D" } } } New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter $params # List pending approval requests Get-MgRoleManagementDirectoryRoleAssignmentScheduleRequest -Filter "status eq 'PendingApproval'" # Approve a request # (Requires appropriate permissions)

# Bulk PIM Eligible Assignment from CSV # CSV Format: UserPrincipalName,RoleDefinitionId,Duration # john@contoso.com,62e90394-69f5-4237-9190-012177145e10,P90D # jane@contoso.com,194ae4cb-b126-40b2-bd5b-6091b380977d,P180D Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory" $assignments = Import-Csv "pim-assignments.csv" foreach ($assignment in $assignments) { # Get user ID $user = Get-MgUser -Filter "userPrincipalName eq '$($assignment.UserPrincipalName)'" if ($user) { $params = @{ Action = "adminAssign" Justification = "Bulk assignment via automation" RoleDefinitionId = $assignment.RoleDefinitionId DirectoryScopeId = "/" PrincipalId = $user.Id ScheduleInfo = @{ StartDateTime = (Get-Date).ToUniversalTime() Expiration = @{ Type = "afterDuration" Duration = $assignment.Duration } } } try { New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter $params Write-Host "✓ Assigned $($assignment.UserPrincipalName)" -ForegroundColor Green } catch { Write-Host "✗ Failed: $($assignment.UserPrincipalName) - $($_.Exception.Message)" -ForegroundColor Red } } } Disconnect-MgGraph

Custom PIM Notification via Logic App: Scenario: Notify Slack/Teams on Global Admin activation 1. Create Logic App → Consumption or Standard plan 2. Trigger: Recurrence (every 5 minutes) 3. Action: HTTP - Query Graph API GET https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignmentScheduleInstances ?$filter=roleDefinitionId eq '62e90394-69f5-4237-9190-012177145e10' Authentication: Managed Identity with Graph permissions 4. Action: Parse JSON - Parse response to get active assignments 5. Condition: Check for new activations - Compare with previous run - Or check StartDateTime within last 5 minutes 6. Action: Post to Teams/Slack - Webhook URL - Message: "🚨 Global Admin activated by [User] at [Time]" 7. Optional: Store state - Azure Table Storage - Track known activations Benefits: - Real-time notifications - Custom channels (beyond email) - Integrate with incident management

Emergency Access Accounts (Break-Glass): Purpose: - Access when all other methods fail - MFA provider outage - PIM unavailable - Conditional Access lockout - IdP federation failure Requirements: - At least 2 accounts (redundancy) - Cloud-only (no federation dependency) - Excluded from ALL Conditional Access - PERMANENT Global Admin (exception to PIM) - Long, complex passwords - Different storage for each account Naming Convention: - BreakGlass1@contoso.onmicrosoft.com - BreakGlass2@contoso.onmicrosoft.com - Use .onmicrosoft.com (no custom domain dependency) Password Strategy: - 25+ characters - Randomly generated - Split between physical locations - Part 1: Secure safe location A - Part 2: Secure safe location B - Both parts needed to reconstruct

Navigate to: Entra ID → Users → New user Account 1: - User principal name: BreakGlass1@contoso.onmicrosoft.com - Display name: Break Glass Account 1 - Password: Generate 25+ character random password - Account enabled: Yes - MFA: Do NOT register MFA device Assign Roles: → Assigned roles → Add assignment → Global Administrator → Assignment type: Active (NOT Eligible!) → Permanent (no expiration) Account 2: - Repeat with BreakGlass2@contoso.onmicrosoft.com - Different password - Same Global Admin role Exclude from Conditional Access: → Security → Conditional Access → Edit EVERY policy → Exclude users: BreakGlass1, BreakGlass2 Or create exclusion group: - Group: CA-Exclusions-BreakGlass - Add both accounts - Exclude group from all policies

# Alert on ANY break-glass sign-in # Log Analytics Query SigninLogs | where UserPrincipalName startswith "BreakGlass" | project TimeGenerated, UserPrincipalName, IPAddress, Location, AppDisplayName, ResultType, ResultDescription # Create Alert Rule Navigate to: Log Analytics → Alerts → New alert rule Condition: - Signal: Custom log search - Query: Above query - Threshold: Greater than 0 Actions: - Action group: Security Team - Email: security@contoso.com - SMS: On-call security - Severity: Critical (Sev 0) Alert Logic: - Evaluation frequency: 5 minutes - Lookback period: 5 minutes - Any sign-in = immediate alert # Sentinel Analytics Rule SigninLogs | where UserPrincipalName has "BreakGlass" | extend AlertTitle = strcat("Break-Glass Account Used: ", UserPrincipalName) | project TimeGenerated, AlertTitle, UserPrincipalName, IPAddress

Quarterly Break-Glass Testing: TEST PROCEDURE: 1. Retrieve password parts from secure storage 2. Assemble complete password 3. Sign in to Azure Portal 4. Verify Global Admin access works 5. Sign out immediately 6. Document test in security log 7. Return password parts to storage ROTATION PROCEDURE (Annual): 1. Create new password (25+ characters) 2. Update account password 3. Split new password 4. Store parts in separate locations 5. Destroy old password documentation 6. Update break-glass documentation DOCUMENTATION: Store in secure location (not digital): - Account UPNs - Password part locations - When to use procedures - Who can authorize usage - Post-usage procedures USAGE AUTHORIZATION: Require verbal authorization from: - CISO or Deputy CISO - Security Director - Document who, when, why POST-USAGE: 1. Rotate password immediately 2. Review all actions taken 3. Document incident 4. Analyze root cause of lockout