Examine Privileged Identity Management. Identity management is the process of ensuring users in our organization have just the right privileges to complete the task they need to accomplish. The goal of Privileged Identity Management or PIM is to avoid assigning excess privileges to users. Failure to do so may lead to the exploitation of privileges, resulting in users who can do tasks that they otherwise shouldn't be able to. Privileged Identity Management is an Azure Active Directory service that enables us to manage, control, and monitor access to important resources in our organization. These include resources such as Azure Active Directory, Azure, Microsoft 365, and Microsoft Intune.

Some of the key features of PIM include: providing just-in-time privileged access to Azure Active Directory and Azure resources; assigning time-bound access to resources by using start and end dates; requiring approval to activate privileged roles; enforcing Azure Active Directory Multi-factor Authentication to activate any role; using justification to understand why users want to activate a role; getting notifications when privileged roles are activated; conducting access reviews to ensure that users still need roles; and downloading an audit history for an internal or external audit.

To set up PIM, we must complete the following steps. First we have to identify and select the Azure resources we wish to protect with PIM. There's no limit to how many can be selected here, but it should be critical production resources. Next we grant access to other personnel to manage PIM by assigning them as a Privileged Role Administrator. Last we need to elevate access for a global administrator which allows them to view all resources and assign access to any subscription or management group in the directory. To implement PIM, we first must identify the roles that we wish to protect with this feature and then assign eligible users to these roles. When one of those users needs to use their privileged role, they activate the role in Privileged Identity Management. As part of this activation, users may be required to use Multi-factor Authentication, request approval, or provide a business justification.

Once the role is active, the user will be able to perform the necessary actions and the role will remain active for a pre-configured period of time. At the end of that time, the access and role are returned to a dormant state. Privileged Access Management or PAM allows granular access control over privileged admin tasks in Microsoft 365. It can help protect our organization from breaches that might use existing privileged admin accounts with standing access to sensitive data or access to critical configuration settings. By enabling PAM in Microsoft 365, organizations can operate with zero standing privileges. This design provides a layer of defense against vulnerabilities arising because of such standing administrative access.