mcpField
A
azure-pim

azure-pim

github.com/vinayaklattheSecurity17882 installsUpdated 19w ago
Repository

About azure-pim

azure-pim is a skill for administrators governing privileged access with Microsoft Entra Privileged Identity Management. It guides migration from permanent assignments to eligible access, activation controls, access reviews, and audit alerts.

Key features

  1. 01Inventory and convert permanent assignments
  2. 02Configure tiered activation controls
  3. 03Manage privileged groups and Azure roles
  4. 04Schedule recurring access reviews
  5. 05Set alerts and audit PIM activity

Use cases

  1. 01Move standing admin roles to eligible access
  2. 02Require approvals and strong MFA for Global Admin
  3. 03Review Tier 0 access quarterly
  4. 04Detect role activation outside PIM

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/vinayaklatthe/microsoft-security-skills --skill azure-pim

After installing, type/azure-pimin Claude Code to confirm it loaded.

Details

From the project README

Microsoft Entra Privileged Identity Management (PIM)

PIM provides just-in-time, time-bound, approval-based, and audited elevation for privileged roles - eliminating standing administrative access and reducing the attack surface for high-value accounts. Requires Entra ID P2.

When to use

Governing privileged access to Entra roles, Azure RBAC roles, and privileged groups. Use this skill for moving permanent assignments to eligible, configuring activation controls, and running recurring access reviews.

Do not use this skill for resource access packages (entra-id-governance) or risk detection (entra-id-protection).

Pick activation controls by role tier

Role tierExamplesApprovalMFA strengthMax activation duration
Tier 0 - control planeGlobal Admin, Privileged Role Admin, Privileged Auth AdminRequired (2 approvers)Phishing-resistant1 hour
Tier 0 - AzureOwner on management group / root subscriptionRequiredPhishing-resistant2 hours
Tier 1 - workload adminExchange Admin, SharePoint Admin, Intune AdminRequired (1 approver)Phishing-resistant4 hours
Tier 1 - AzureOwner / Contributor on production subscriptionJustification + ticketMFA4 hours
Tier 2 - operationalHelpdesk, Reports Reader, Security ReaderJustificationMFA8 hours

Rule of thumb: the two-approver requirement on Global Admin is the single highest- value PIM control. It blocks self-elevation and forces a witness for every tenant-wide change.

Approach

  1. Inventory permanent assignments — Use Get-MgRoleManagementDirectoryRoleAssignment and the Azure portal Assignments view per subscription. Categorise by tier. Target: zero standing assignments outside break-glass. Verify: PIM → Entra roles → Assignments → Active shows only break-glass accounts for Global Admin.

  2. Convert to eligible in waves — Tier 2 first (low blast radius if activation flow breaks), then Tier 1, then Tier 0. Give admins 7 days notice + a walkthrough video. Verify: weekly activation count rises as expected; no admin complaints about lost access.

  3. Configure activation settings per role — Match the tier table above. Phishing-resistant MFA = require the authentication strength, not generic MFA. Verify: Global Admin activation requires 2 approvers and phishing-resistant strength.

  4. PIM for Groups — Use for privileged groups that aren't Entra roles (e.g. "Tier 0 Admins" group with multiple role assignments, AD-synced groups holding sensitive RBAC). Activate the group, not each role individually.

  5. PIM for Azure resources — Onboard subscriptions and management groups. Convert Owner and User Access Administrator to eligible. Scope time-bound assignments narrowly (resource group, not subscription, where possible).

  6. Recurring access reviews — Quarterly for Tier 0, bi-annually for Tier 1. Reviewer is the role assignee's manager, not the admin team. "No response" defaults to remove (with 24-hour grace period notification). Verify: review completion rate > 90%; removed assignments captured in audit log.

  7. Alerts and audit — Enable: "Too many global admins", "Roles activated outside PIM", "Activation doesn't require approval". Stream PIM audit (AuditLogs table) to Sentinel.

Guardrails

  • Two break-glass accounts with permanent Global Admin, excluded from PIM. Monitored on every sign-in. If PIM has an outage, you still have a way in.
  • Two approvers for Global Admin activation. A single approver = self-approval if both approvers are admins. Two breaks that loop.
  • Phishing-resistant MFA for Tier 0 activation. SMS MFA at Global Admin elevation is unacceptable in 2026.
  • Time-bound, narrow scope for Azure RBAC. Resource group > subscription > management group. Tighter scope = lower blast radius if compromised.
  • Don't use "I just need it for a moment" as a justification. Audit the justifications - if they're meaningless, the control isn't working.
  • Access reviews quarterly minimum. Annual reviews allow 12 months of accumulated stale access.

Common anti-patterns

  • "Standing Global Admin for the IT team" - The exact attack surface PIM exists to eliminate. Move to eligible with approval.
  • "Approval optional - admins are trusted" - Removes the witness requirement and the audit trail. Always require approval for Tier 0.
  • "One approver" - Self-approval loop if the approver is also an admin. Two minimum.
  • "PIM for Entra roles only, Azure RBAC stays standing" - Cloud subscription Owner is the biggest blast radius in many tenants. Cover Azure too.
  • "Reviews once a year" - 12 months of drift. Quarterly for Tier 0.
  • "Justification field optional" - Without justification, the audit log loses context. Required everywhere.
  • "Use PIM for shared service accounts" - Service accounts can't approve interactively. Use managed identities + RBAC, not PIM.

Example prompts

  • Inventory standing admin assignments in our tenant and target zero outside break-glass.
  • Configure PIM activation for Global Admin with 2 approvers and phishing-resistant MFA.
  • Set up PIM for Azure resource roles (Owner on production subscription).
  • Configure quarterly access reviews for Tier 0 roles with auto-remove on no response.
  • Alert when a Global Admin is added outside PIM or activated more than 5 times a week.
  • Migrate our "Privileged Admins" security group to PIM for Groups.

Microsoft Learn

Comments

Markdown supported