Mastering Microsoft Entra Privileged Identity Management: A SkyCore Implementation Guide for SMBs

Step 1: Verify Licensing and PIM Readiness

Before diving into configuration, it's crucial to confirm that your Microsoft Entra tenant is properly licensed for Privileged Identity Management. PIM functionality is enabled automatically once a Microsoft Entra ID P2 or Microsoft Entra ID Governance license is detected in your tenant. Having the correct license is the foundational step for PIM activation.

# Check your Microsoft Entra ID tenant's SKU and verify P2 or Governance license
az ad sp show --id "00000002-0000-0ff1-ce00-000000000000" --query "appDisplayName,tags"

• --id "00000002-0000-0ff1-ce00-000000000000": This GUID represents the Microsoft Graph application, which is present in all Microsoft Entra ID tenants. Querying it allows us to infer tenant capabilities.
• --query "appDisplayName,tags": Retrieves the display name and associated tags, which can sometimes indicate advanced feature licenses, though direct license check for Entra ID P2 is best done in the portal.

# Using Microsoft Graph PowerShell to check your tenant's assigned SKUs (requires 'Directory.Read.All' scope)
Connect-MgGraph -Scopes "Directory.Read.All"
Get-MgSubscribedSku | Select-Object SkuPartNumber, SkuId, CapabilityStatus, ServiceInfo

• Connect-MgGraph -Scopes "Directory.Read.All": Establishes a connection to Microsoft Graph with the necessary permissions to read directory information.
• Get-MgSubscribedSku: Retrieves information about the licenses assigned to your tenant. Look for AAD_PREMIUM_P2 or AAD_GOVERNANCE in the SkuPartNumber.

Portal alternative: Sign in to the Microsoft Entra admin center as a Global Administrator. Browse to Microsoft Entra ID > Overview > Properties. Look for your 'License' field. Alternatively, navigate to Identity > Billing > Licenses to view assigned licenses.

Run this to verify: Once licensed, PIM is automatically available. Navigate to Identity Governance > Privileged Identity Management in the Microsoft Entra admin center. If you see the PIM dashboard and options, it's active.

Step 2: Identify Critical Microsoft Entra Roles for PIM

The core principle of PIM is to protect your most sensitive administrative roles. For SMBs, this typically includes roles that can make widespread changes, access sensitive data, or manage user identities. Start by listing your current administrative role assignments to understand your baseline.

# List all active Microsoft Entra role assignments
az ad role assignment list --all --query "[].{Principal:principalDisplayName, Role:roleDisplayName, Scope:scope, Type:assignmentType}"

• --all: Ensures all assignments are returned.
• --query "...": Formats the output to show the principal's display name, the role's display name, the scope of the assignment, and the assignment type.

# List all active Microsoft Entra role assignments using Microsoft Graph PowerShell
Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment | Select-Object @{N='Principal';E={(Get-MgUser -UserId $_.PrincipalId -ErrorAction SilentlyContinue).DisplayName}}, @{N='Role';E={(Get-MgDirectoryRoleTemplate -DirectoryRoleTemplateId $_.RoleDefinitionId -ErrorAction SilentlyContinue).DisplayName}}, Scope, AssignmentType

• Connect-MgGraph -Scopes "RoleManagement.Read.Directory": Connects to Graph with permissions to read directory role management.
• Get-MgRoleManagementDirectoryRoleAssignment: Retrieves all directory role assignments.
• The Select-Object with calculated properties helps resolve PrincipalId and RoleDefinitionId to human-readable names.

Portal alternative: Sign in to the Microsoft Entra admin center. Browse to Identity > Roles & admins > Roles & admins. Here you can see a list of all Microsoft Entra roles. Selecting a role will show its assignments.

Recommended Roles for PIM: Based on the principle of least privilege, SkyCore Solutions recommends managing the following roles with PIM for most SMBs:

• Global Administrator: The most powerful role. Should have zero standing assignments, only eligible PIM access.
• Privileged Role Administrator: Manages PIM itself. Also critical for JIT access.
• Exchange Administrator
• SharePoint Administrator
• User Administrator
• Security Administrator

Step 3: Configure PIM Settings for Microsoft Entra Roles

This is where you define the activation requirements for each privileged role. These settings dictate how a user will activate an eligible role assignment. The goal is to enforce strong authentication, provide accountability through justification, and limit the duration of elevated access.

The provided documentation focuses on the portal for configuring these specific PIM role settings. While advanced automation via Microsoft Graph API is possible, the intuitive nature of the portal makes it suitable for SMBs managing a handful of critical roles.

Portal steps:

1. Sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator.
2. Browse to Identity Governance > Privileged Identity Management.
3. Under Manage, select Microsoft Entra roles.
4. Select Roles to see the list of Microsoft Entra roles.
5. Select the specific role you want to configure (e.g., Global Administrator).
6. Select Role settings, then click Edit.
7. Configure the following settings (SkyCore recommendations for SMBs):
   • Activation maximum duration: Set to 2 hours. This minimizes the window of vulnerability.
   • Require multifactor authentication: On. Essential for security.
   • Require justification: On. Provides an audit trail for why access was needed.
   • Require approval to activate: On. For highly sensitive roles (Global Admin, Privileged Role Admin), specify at least one or two dedicated approvers (ideally a security group).
   • Require incident ticket value: Off (unless you have a formal IT service management system).
   • Notifications: Ensure email notifications are enabled for activation.
8. Click Update to save the role settings. Repeat this process for all identified critical roles.

Run this to verify: After configuring, revisit the role settings in the portal to ensure your changes have been applied. There isn't a direct CLI command to inspect these PIM-specific role settings from the provided documentation, as these are managed within the PIM service itself. Verification is typically done visually in the portal.

Step 4: Assign Eligible Roles to Users and Groups

Now that the PIM settings are configured for your chosen roles, you can assign users or groups as 'eligible' for these roles. An eligible assignment means the user can activate the role when needed, subject to the PIM settings defined in the previous step. This is the cornerstone of Just-In-Time access.

The provided Microsoft Learn documentation explicitly details how to create eligible assignments for Microsoft Entra roles via the Azure portal. For direct programmatic creation of *eligible* PIM assignments for Microsoft Entra roles, advanced Graph API calls (often requiring beta endpoints) are typically used, but specific Azure CLI or PowerShell cmdlets for this particular action are not provided in the reference documentation.

# Example: List Microsoft Entra ID roles to get their object IDs for reference
az ad role list --query "[?displayName == 'Global Administrator'].id" -o tsv
az ad role list --query "[?displayName == 'Privileged Role Administrator'].id" -o tsv

• --query "[?displayName == 'Global Administrator'].id" -o tsv: Filters the list to find the Object ID of the 'Global Administrator' role, outputting it as plain text.

# Example: List Microsoft Entra ID roles and their definitions for reference
Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgDirectoryRoleTemplate | Select-Object DisplayName, Id
Get-MgUser -UserId "admin@skycore.ca" # Get user object ID if needed

• Get-MgDirectoryRoleTemplate: Lists the templates for built-in Microsoft Entra roles, providing their DisplayName and Id.
• Get-MgUser -UserId "admin@skycore.ca": Retrieves user details, including their object ID, which is often needed for assignments.

Portal steps (primary method for eligible assignments as per documentation):

1. Sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator.
2. Browse to Identity Governance > Privileged Identity Management > Microsoft Entra roles.
3. Under Manage, select Roles.
4. Click Add assignments.
5. On the Add assignments page, click Select a role.
   • Choose the role you want to make eligible (e.g., Global Administrator).
   • Click Select.
6. Click Select members.
   • Search for and select the users or groups you want to make eligible for this role.
   • Click Select.
7. Click Next.
8. On the Settings tab:
   • For Assignment type, choose Eligible.
   • For Assignment duration, you can choose 'Permanently eligible' or 'Time-bound eligible'. For SMBs, SkyCore recommends 'Time-bound eligible' for all but the most unique break-glass accounts, ensuring eligibility itself expires if not renewed. Set an appropriate start and end date.
9. Click Assign.

Run this to verify: To confirm the eligible assignment:

Portal verification: In the PIM blade, under Manage > Microsoft Entra roles > Assignments. Filter by 'Eligible assignments' to see the newly added users/groups.

Step 5: Educate Users on Role Activation Workflow

With eligible assignments in place, the next crucial step is to ensure your administrative users understand how to activate their privileged roles when needed. The user experience is straightforward and designed to integrate seamlessly with their existing Microsoft Entra ID login.

There are no CLI or PowerShell commands for a user to *activate* an eligible PIM role, as this is an interactive process for the end-user.

User activation steps:

1. Users sign in to the Microsoft Entra admin center.
2. Browse to Identity Governance > Privileged Identity Management.
3. Under My roles, select Microsoft Entra roles.
4. Users will see a list of roles for which they are 'eligible'. They can select the role they need to activate.
5. Click Activate.
6. Depending on the role settings configured in Step 3, they will be prompted to:
   • Complete Multi-Factor Authentication (if required).
   • Provide a justification for activation.
   • Submit for approval (if required, they will then wait for an approver to grant access).
7. Once approved (if applicable) and conditions met, the role will become 'active' for the specified duration.

Run this to verify: As an administrator, you can check active assignments:

Portal verification: In the PIM blade, under Manage > Microsoft Entra roles > Assignments. Filter by 'Active assignments' to see activated roles and their remaining time. Also, under Activity > Microsoft Entra roles > Audit history, you can see all activations.

Step 6: Implement Regular Access Reviews and Audit PIM Activity

Privileged Identity Management is not a 'set it and forget it' solution. Ongoing vigilance is critical. Regular access reviews ensure that users still require their eligible assignments, while auditing provides a comprehensive trail of all privileged actions.

The provided documentation outlines access reviews and audit history primarily through the portal. While Microsoft Graph API can interact with access reviews, for SMBs, the portal offers a user-friendly interface for managing these governance tasks.

# Example: View your own PIM audit history (specific to the logged-in user)
Connect-MgGraph -Scopes "RoleManagement.Read.All"
Get-MgRoleManagementDirectoryRoleAssignmentScheduleRequest -Filter "principalId eq 'YOUR_OBJECT_ID'" | Select-Object Status, RequestType, Action, CreatedDateTime

• -Filter "principalId eq 'YOUR_OBJECT_ID'": Filters for requests made by your user object ID. Replace 'YOUR_OBJECT_ID' with your actual object ID.
• Select-Object Status, RequestType, Action, CreatedDateTime: Displays relevant audit information for your requests.

Portal steps for Access Reviews:

1. Sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator.
2. Browse to Identity Governance > Privileged Identity Management > Microsoft Entra roles.
3. Under Manage, select Access reviews.
4. Click New access review.
   • Choose to review Microsoft Entra roles.
   • Give the review a name and description.
   • Select Start date and Frequency (e.g., quarterly).
   • Select the roles to review (e.g., Global Administrator, Privileged Role Administrator).
   • Specify Reviewers (e.g., role owners, security team, or self-review).
   • Configure Upon completion settings (e.g., Auto apply results, Disable users if not reviewed).
5. Click Start.

Portal steps for Audit History:

1. Sign in to the Microsoft Entra admin center as at least a Global Administrator or Security Administrator.
2. Browse to Identity Governance > Privileged Identity Management > Microsoft Entra roles.
3. Under Activity, select Audit history.
4. Here, you can view all PIM-related events, including role activations, assignments, and setting changes. Use filters to narrow down events by user, role, or date. This audit history is invaluable for compliance and forensic analysis.

Run this to verify: After starting an access review, ensure it appears under the 'Access reviews' tab. After an activation, verify the event is logged in 'Audit history'.