How Do You Measure Privilege Creep Across Azure and Legacy Apps?
We've used Privileged Identity Management for more than a year, and it works well for native Entra ID roles and Azure resources. The problem is the legacy and…
PIM
What’s the most practical way to use separate Microsoft 365 admin accounts?
We're a two-person IT team supporting about 225 users on Microsoft 365 Business Premium. Our Windows workstations are Entra joined and managed with Intune. We're moving administrative roles…
How can Terraform manage Entra ID roles without giving pipelines excessive privileges?
How do you safely manage Entra ID role assignments and Privileged Identity Management (PIM) eligibility with Terraform? The deployment service principal needs a highly privileged role to assign…
How can Terraform manage Entra ID roles without giving pipelines excessive privilege?
I'm managing Entra ID role assignments and Privileged Identity Management eligibility with Terraform. The deployment service principals need highly privileged permissions—potentially enough to assign Global Administrator—which creates a…
Why can’t User Administrator enable a disabled account in Entra ID?
I'm testing the User Administrator role in Microsoft Entra ID and expected it to let me manage and re-enable regular user accounts. However, when I try to enable…
Why can’t User Administrator enable a disabled account in Entra ID?
I'm trying to re-enable a disabled user account in Microsoft Entra ID. Documentation indicates that the User Administrator role should be able to manage users, but selecting the…
How should we redesign Azure RBAC across multiple subscriptions?
We have an Azure environment with multiple subscriptions where users currently receive Owner and Contributor permissions at a broad tenant or root management-group scope. Those assignments are inherited…
How Can I Retrieve Maximum PIM Role Activation Durations with Microsoft Graph?
I built a PowerShell script that activates five or six Privileged Identity Management roles together instead of requiring each role to be activated manually. The remaining problem is…
Why can’t I access App Registrations with the Application Developer role?
I have the Application Developer role assigned in Microsoft Entra ID. When I open App Registrations in the Azure portal, my applications appear briefly with their names and…
Comparing Entra ID Access Reviews and Time-Limited Eligibility in PIM
I'm curious about the overlap between Entra ID access reviews and time-limited eligibility periods in Privileged Identity Management (PIM). It seems you can either set PIM users to…
Issues with Azure PIM Role Activation Delays
I'm trying to improve the offboarding process for OneDrive users, particularly when our scripts don't apply. Ideally, I want my admins to manually use the 'copy to' function…
Issues with Using PIM for Admin Roles in Azure
I've been working on updating our offboarding procedures for OneDrive and I want my admins to be able to manually use the 'copy to' feature for a user's…
Anyone else having trouble with Azure role requests?
Is anyone else finding it difficult to request roles in Azure this morning? I've been trying to activate a couple of roles, but the process keeps stalling and…
Is Entra PIM's Authentication Context Bypassable with Certain Browsers?
I've noticed a concerning issue with Entra PIM's Conditional Access policies for authentication contexts. When using Microsoft Edge on Windows or Safari on iOS, the requirement to reauthenticate…
Why can't I set users to permanently eligible in my new PIM group?
I'm trying to implement PIM for my Groups and recently created a group that includes User Administrator, Exchange Recipient Administrator, and SharePoint Administrator roles. I was able to…
Why am I seeing a permissions error in the TEAMS admin portal despite having the right roles?
I've been trying to access the TEAMS Admin portal, but I keep getting this error message: "Your permissions seem to have expired or were just elevated recently." This…
Experiencing Delays with PIM Activation, Anyone Else?
I've recently started using Privileged Identity Management (PIM) at my new job after having experience with it in previous roles. However, I'm facing some frustrating delays, especially with…
How to Get Email Alerts for Azure Access Management Changes?
Hey everyone, I need help figuring out how to set up an alert for when someone uses the "Access manage for Azure Resources" feature. Specifically, this option allows…
How to Require MFA Again When Activating a PIM Role?
I've been searching through various posts and blogs, but most of them are quite outdated and don't provide the answers I need. I'm trying to find out if…
Managing PIM for Azure Resources at Scale
We recently completed a merger between two clients and set up a new Azure tenant. From the get-go, we implemented Privileged Identity Management (PIM) for all Azure resource…