I'm managing Entra ID role assignments and Privileged Identity Management eligibility with Terraform. The deployment service principals need highly privileged permissions—potentially enough to assign Global Administrator—which creates a serious blast radius if a pipeline or its credentials are compromised.
How do organizations handle this risk in practice? Are there controls that prevent the service principal from assigning especially sensitive roles? Is it possible to require a human to activate the service principal's privileged role through PIM only when the pipeline needs to run, rather than keeping that role permanently assigned?
2 Answers
Service principals can’t activate PIM roles interactively during a pipeline run in the same way a user can. The practical approach is to reduce the exposure around the service principal: strictly control who can trigger the relevant pipeline, restrict which pipelines are allowed to use that identity, protect the pipeline configuration and secrets, and separate ordinary deployments from the pipeline that manages privileged role assignments.
For particularly sensitive roles, many teams use a controlled, human-approved process rather than leaving the service principal permanently able to grant them.
There isn’t a perfect way to eliminate this risk. One option is to have a user activate Privileged Role Administrator through PIM and run the Terraform that manages role configuration directly under that user identity, outside the pipeline. The tradeoff is losing a fully automated pipeline.
If the process must remain automated, the service principal generally needs Privileged Role Administrator before the pipeline runs. You could manage that temporary assignment with a small, tightly controlled Terraform root module and remove it immediately afterward with `terraform destroy`, but this still requires protecting the mechanism that grants the temporary privilege.
Related Questions
How To: Running Codex CLI on Windows with Azure OpenAI
Set Wordpress Featured Image Using Javascript
How To Fix PHP Random Being The Same
Why no WebP Support with Wordpress
Replace Wordpress Cron With Linux Cron
Customize Yoast Canonical URL Programmatically