At a time when security breaches seem to be an everyday occurrence, it’s become more and more important to protect resources with more than just a username and password. It’s even more important to protect resources from INTERNAL threats. By implementing Azure AD Privileged Identity Management, organizations can protect their resources with improved security features, and even keep an eye on what legitimate administrators are doing.
In this course, you’ll learn how to implement Azure AD Privileged Identity Management. We’ll start the course by touching on an overview of what Azure AD Privileged Identity Management is and what it offers. We will then work through the deployment of PIM and how it works with multi-factor authentication. As we work through some demos, you will learn how to enable PIM and how to navigate tasks in PIM.
We’ll then cover the activation of roles and the assignment of those roles, including permanent roles and just-in-time roles. We’ll also cover the concepts of updating and removing role assignments, reinforcing these concepts through demonstrations.
We’ll round out the course with supported management scenarios, configuring PIM management access, and how to process requests.
Learning Objectives
- Enable PIM
- Activate a PIM role
- Configure just-in-time resource access
- Configure permanent access to resources
- Configure PIM management access
- Configure time-bound resource access
- Create a Delegated Approver account
- Process pending approval requests
Intended Audience
- People who want to become Azure cloud architects
- People who are preparing to take Microsoft’s AZ-101 exam
Prerequisites
- Moderate knowledge of Azure Active Directory
To see the full range of Microsoft Azure Content, visit the Azure Training Library.
Microsoft recommends that multi-factor authentication, also known as MFA, be required and enforced for all administrators. By leveraging multi-factor authentication, the risk of an attack due to a stolen password is mitigated. As such, you can force users to complete an MFA challenge whenever they log in. You can and should also require users to complete an MFA challenge whenever they activate a role in PIM. Doing so ensures that even if a user doesn't complete an MFA challenge when he logs in, he will still be prompted to do so by PIM. When a user activates a privileged role, there are two options for validating MFA for the user. The first option is to rely on Azure MFA for the user who activates the role. To leverage this first option for validating MFA, first ensure that the user is licensed if necessary and has registered for Azure MFA.
Although it's not required, it is recommended that Azure AD be configured to enforce MFA for the user when he logs in. This is because PIM itself will make the MFA check. If your users authenticate on-prem, you can leverage the second option by having the current identity provider be responsible for MFA. For example, let's assume you've configured AD Federation Services or ADFS to require smart card-based authentication before accessing Azure AD. You could configure ADFS to send claims to Azure AD. In this scenario, whenever a user tries to activate a role, PIM will see that MFA has already been validated for the user and allow access.
Tom is a 25+ year veteran of the IT industry, having worked in environments as large as 40k seats and as small as 50 seats. Throughout the course of a long an interesting career, he has built an in-depth skillset that spans numerous IT disciplines. Tom has designed and architected small, large, and global IT solutions.
In addition to the Cloud Platform and Infrastructure MCSE certification, Tom also carries several other Microsoft certifications. His ability to see things from a strategic perspective allows Tom to architect solutions that closely align with business needs.
In his spare time, Tom enjoys camping, fishing, and playing poker.