Enable Azure AD Privileged Identity Management (PIM)

0:00Introducing privilege identities. So giving everyone admin level access is obviously not the right thing to do. That's obviously a security risk, but the flip side of that is sometimes are end users legitimately need the admin level access in order to perform the tasks to do their job. I mean, take a look at this guy right here. He is developing some code on his website, he's ready to deploy it to test, and it turns out that the DevOps engineer never actually made the correct deployment slots before they quit their job.

0:30Well, now this guy needs to stand up a deployment slot so that he can deploy as code and test it out, but he doesn't have the access to do it. So, yeah, we could use something like RBAC, role-based access controls, or we could grant this guy owner level privileges to the resource group or the resource itself, then he could deploy whatever he'd want and run up whatever bill he wants, or we could look in to some more powerful identity management tools. What privilege identity management in Azure is all about is the concept of least privilege but ratchet it up a notch.

1:02And I am just so excited that I get to talk to you about PIM. I just want to pull up the Azure portal right now, dive in and start showing you how it works, and just say, you can figure it out as you go along, but we got to slow down because this is kind of a big topic and we need to set up some key terms and some key processes upfront. At the heart of PIM is the concept of permanent privilege versus eligible privilege. Now permanent privileges is exactly what it sounds like. It's exactly what we did when we were doing RBAC, when we talked about role-based access controls.

1:32When you grant someone the global administrator right and do nothing else, they are the global administrator. Their role is now permanently global administrator and they can permanently do whatever they want. But if we use something like PIM, permanent doesn't go away, but now we can say that this particular user, like this code developer right here, is now eligible for an owner role. And if they want to use those owner level privileges, they have to go through an elevation task or elevation workflow in order to be approved in order to get those access rights.

2:09So that approval access looks something like this. So let's say he is ready to deploy his code, but he can't deploy his code because he needs to actually spin up a deployment slot first, and that does require at least contributor level access, but owner level access could work as well. So what this guy is going to do is he's going to log into Azure and go to the PIM portal where he's going to request elevated rights for the role that he is eligible for. He simply clicks an Elevate button that kicks off the workflow in order to start him in elevating his tasks.

2:40Now if we have granted him the ability to do that, if he is actually truly eligible to do it, then he can go through several different kinds of steps in order to actually get elevated. The first option, we could simply force him to use multi-factor authentication, because if he's got his cell phone, then we know that he is who he is because he not only knows something, but he also has something in order to verify his identity. The other thing that we can do is we can enable something called time-bound access, and this is saying that he is only allowed to elevate his privileges during a specific time set.

3:13For instance, if we know he's going to be working on deploying this code, and he may need some special privileges, we can allow him to elevate is permission for the next 48 hours, let's say. And then beyond that, we can say during that 48 hours, he's only allowed to elevate his privileges for one hour at a time. Now he can't go through renewal process, but he has to give reasoning, documented reasoning, as to why he's asking to extend his elevated privileges. And the actual last option that we could actually setup is we could set up an approval workflow process, so that if this particular user requests to elevate his privileges, this workflow process would actually fire off an email to an approving manager or any other person that we delegate permission to to approve this particular developers access.

4:01And once it's been approved, this particular user will get notified you've been approved, and you have this much time to do your work. So do you see how this is way more powerful than something like role-based access controls? In this particular instance, we'll actually be able to keep running tabs on who is doing what and when because we're granting privileges to people if they have to go through an elevation process in order to actually get the rights that they are requesting. This is the concept of just in time access. They get the access that they need just in time to perform the action they need to do, and they only have access for the length of time that we delegate or designate.

4:41And the best case example of this is a global admin. The global admin rarely actually needs global admin rights. They don't do global admin tasks day in and day out. So they should only have to elevate into global admin when they truly need to do it. And by setting up PIM in this particular instance and not having permanently assigned to all these roles, we are reducing our attack footprint tremendously. Now some key prereqs that go into PIM. First of all, you have to have an Azure AD Premium P2 license or an EMS, that's Enterprise Mobility and Security Suite, E5 license.

5:18And once those are enabled, the global admin who is actually going to be enabling PIM within the environment, they also have to have multi-factor authentication already set up. But once you've got those, you're good to go. You're ready to start rocking and rolling with PIM. So we've introduced privileged identities, this amazing technology where we can really lock down who is doing what and when. Over the next few Nuggets, we're going to be enabling PIM in our environment, then setting up things like just in time access, the time-bound access, and the approval workflow. We'll see you there. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00Enabling Privilege Identity Management-- Yeah, PIM sounds pretty great, right? I mean, the idea here is that you only get the administrative access when you need the administrative access. And there's a system of checks and balances here, so that people can only get administrative access when they've gone through a sort of workflow or approval process. And this is a huge benefit to us, because it's going to cut down on careless accidents happening because people are over provisioned with access. And it's also going to reduce our attack footprint because as soon as an account gets compromised, the hacker doesn't have administrative access by default.

0:33So we're convinced. This is what we want. It's time to jump in the portal and get started going. You can get to PIM by doing Create a Resource and just searching for it. Or you can see right here, I've got Azure AD Privilege Identity Management already pinned. Going to All Services and searching for Privilege Identity Management will also bring that up. So what we need to do to enable PIM is first of all, you have to have an Azure Active Directory P2 license, or an EMSE5 license. That's Enterprise Mobility and Security Suite. So I already have an Azure AD P2 license, so I'm going to click on the Azure AD Privilege Identity Management here.

1:08And what we have to do is we have to consent to enabling Privilege Identity Management. You can see right below the Quick Start button, there's this Consent to PIM. And once it loads up it says, hey, the status has checked out OK, click the Consent button to get going. We'll click Consent. And it's going to say, are you sure? Yep, I'm definitely sure. We'll click Yes, and that's it. That's all there is to getting PIM up and running. Let's just poke around. See what we've got here. Well, first up we've got My Roles. And the very first time you actually click into My Roles, you have to sign PIM up into Azure AD so that it can scan through Azure AD and make sure that it can successfully read all of your roles and current users that you already have.

1:47Just clicking the little sign up button here will do that. And you see it says, sign ups have completed successfully. Feel free to close this window. So we'll do just that. We'll click out, and click back into it. And now we are actually in the Azure AD roles. This particular screen that we're looking at here is the eligible roles. If I were eligible for any roles right here, this is where I could go to activate those roles, or see the current status of that, maybe how much time is left. Now if I want to see the roles that I already have elevated and activated, I can click on Active Roles. And you can see because I am the domain owner here, I by default have three permanently assigned roles.

2:23So we got the Global Administrator here that is permanently assigned. And just a quick overview of the other items in the Setting page. I'll click back on Privilege Identity Management here. We can see my request. These are the requests that I have opened. What is the status of the elevation requests that haven't been sufficiently met yet? Maybe we're waiting on an email approval process, and our boss just hasn't gotten around to clicking Accept yet. We can go poke him and make sure they've got that going. We'll go back to Privilege Identity Management. We also have the ability to approve requests, if we have been delegated the permissions to do that. Similarly, back on Privilege Identity Management, we can also review access for Active Directory roles that we've set up to keep monitoring and reviewing access on too.

3:01So that's it. Setting up and enabling Privilege Identity Management, there's nothing to it. But in the next few Nuggets, we're going to be actually talking about how to configure just in time access, time down access, and the workflow approval process. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00Configuring Just-In-Time Access. So in the last Nugget, we got pim up and running in our environment, but we didn't can figure anything yet and we need to get jumping on that right away because I want to lock down my global admins account. Check this out. If I go to Azure AD roles real quick, and then I simply click on Roles here in the left-hand side, you'll notice the pane did change when I clicked on Azure AD Roles. I'll click on Roles, and we'll scroll on down to Global Admins, and we'll see currently Simon Simoneaux is a permanent global admin user.

0:31Well, I don't want him to be permanent. You see, I'm the only one I want to be permanent because I'm the owner of the company. And I don't want Simon to be permanent by default because he may click on something or do something by accident. I want him to go through an elevation process. So to go about configuring that and the ways that we can actually set up the configuration process, we need to get started like this. Let's go back to Privilege Identity Management. We'll choose Azure AD Roles. Them we'll choose Settings. Then right here, we've got these settings that we can start configuring-- roles, alerts, and access reviews. Well, we're configuring these settings for a role.

1:02So I'll click on Roles, and it'll bring up the list of roles that we can start configuring the settings for. Let's click on Global Administrator, and the first thing we want to draw your attention to is the slider at the top. What is the maximum hours that this role can be activated for? One seems a little tight so I may change that to two, make that a little bit easier. I do want to be notified when another global admin has been activated. So I'll go ahead and enable notifications here so that way we get a notification email when someone has gone through the elevation process. Now, I don't need a ticket request or any sort of item like that, but you can force someone to actually enter in information like a ticketing system when they're going through the request process.

1:41Now, global admins, by default, multi-factor authentication is enabled and you can't change it. So when someone goes to activate this role, it is going to bring up a GUI for them to actually go through a multi-factor authentication approval process. And the last one is the require approval. This is where another user is going to be delegated permissions, and we require them to approve the elevation request. They'll get an email. They just click on the link, choose Approve. Then the end user who's doing the requesting, they'll get an email letting them know that it was approved or denied. So I like these settings that we've got here.

2:12We've changed the hours that it can be activated. We've changed the notifications on activation. We'll click Save, and updated settings successfully. That's that easy Let's go back to Azure AD roles, and this time we'll just click on Roles. Now scroll on down to Global Administrator, and we'll see Simon Simoneaux here. We can see he's still got the permanent access. If I click the little dot dot dot right here, we can change it to make eligible. And now Simon Simoneaux is not a permanent global admin. He will have to go through a multi-factor authentication approval process after he's gone through and elevated his status.

2:45Let's check that out. I've logged out of the portal and logged back in as Simon here. Let's just find our way over to Privilege Identity Management. We'll give it a click, and now we should be able to go into Roles and see what we're eligible for activation. Check it out. My global administrator is currently not active. We don't have any pending requests. And I want to activate it. We know this is going to be activated for two hours. I'll click Activate, and we'll click Activate again, and it says what is the duration that we want to activate this for. I'm just going to go ahead and scale it all the way back to just a half an hour, and my activation reason is demonstration.

3:18How about that? We'll click Activate, and it goes through the three stages of activation here. Stage 1, Processing Your Requests and Activating Your Role. And after about 30 seconds, all three stages have been successful. But check it out. Now we have to sign out and sign back in in order for this to take effect. Guess what? Because that's the multi-factor authentication part. So we'll sign out. We'll sign back in. Type in our password. It's going to prompt me for multi-factor authentication. And now I'm signed back in. Let's just check this out. Let's go back to Privilege Identity Management real quick.

3:50We'll search for Privilege Identity Management, My Roles. And now you can see, under my eligibility roles we actually have valid access here. If we go to Active Roles, you can see it also shows up as active here. And when I'm done, I can simply click Deactivate. Let's just go ahead and do that just for good measure. We'll go ahead and click Deactivate again and click Yes. And after a few seconds, that's it. That's all there is to it. We have now enabled just-in-time access and walked through a demonstration on how our end users can use it. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00Configuring Time-Bound Access. So one of the big distinctions between Just-in-Time access and Time-Bound access is that Just-in-Time access requires the end user to go through an activation and elevation process. Whereas the Time-Bound access, we're just assigning the role or privilege to the end user without them having to go through an activation process. They're going to have the rights they need, not only for a designated amount of time to do it. This is perfect for maintenance windows. This is perfect for standing up new environments. And you know that someone's going to need access for a designated amount of time.

0:34In this particular instance, let's pretend Simon Simoneaux, the guy that we've been picking on throughout this module, needs access to the Owner permission of our subscription for 15 days. What I'm going to do from the PEM portal to get started with that I'm going to click on Azure resources. Now what it brings up on the screen is that we can manage the pay-as-you-go subscription right here. Let's go and give that a click. And something that's just worth pointing out, it brings you into a really cool little dashboard for all of the active role assignments, distribution, and changes over time that are going on within the specified subscription.

1:06So this is a really great dashboard for auditing and seeing what's really going on here. Now to get started configuring this, I'm going to click on Role settings here. And these are all of the role settings that are allowed within that subscription. Let's just search for Owner real quick. And we can see here is Owner. We'll give Owner a click. And this is where we can actually go about setting up the role settings for the Owner privilege. Now the first thing to notice is we've got the distinction between Assignment and Activation. Well, Activation t is talking about the settings hat are revolving around Just-in-Time access, whereas the Assignment here is going to be dealing with the Time-Bound access that we're dealing with.

1:42Now the first two settings here are Allow permanent assignments. Check that out. And if we had an assignment that didn't expire? Well, guess what, that's just a work around to get permanent assignment. Now there is the distinction between a permanent eligible assignment and a permanent active assignment. This is saying we can have someone be permanently eligible. Or we can have someone be permanently active. Well, those are all well and good. But the real Time-Bound access happens right here in the bottom chunk. This is saying expire active assignments after so much time, require multi-factor authentication, and require justification on an active assignment.

2:16So when I go to assign someone, being the administrator, I have to justify why I'm assigning someone with those permissions. One month seems a little too high for me. So I'm going to on the Edit button here. And let's change this to 15 days. We'll also require multi-factor authentication on an active assignment. And if we wanted to go ahead and make sure that we could enable permanent assignments, we could do that right here as well. But I like these settings the way they are. I'll click Update. And we now have the Owner role that has been edited and updated. So let's go back to the roles where we can see and manage the existing roles that we have.

2:50Let's click on Owner. And let's add a member here. We're going to choose our member of Simon Simoneaux. We'll just search for his name. Give him a click. Choose select. You can see his default Assignment type is eligible. And this will actually specify when the eligibility starts and when the eligibility finishes. But to actually make this a Time-Bound access, let's go and changes to be Active. And now we have to enter that justification. We'll just call this Time bound demo. And you can see we've got the 15-day period set up here with the time and date that it starts.

3:22We'll click OK. And we'll click Add. And we've now configured Time-Bound access for our user Simon Simoneaux. I hope this has been informative for you. And I'd like to thank you for viewing.

0:00Configuring PIM eligibility approval workflows-- that is a mouthful. But basically what we're saying is when somebody requests to be elevated into their administrative privileges, we want to have an approval process happen where somebody else that we've delegated permissions to can approve that person's request to be elevated. Now, in the past couple Nuggets, we did just-in-time access. We were talking about Azure Active Directory roles. And then we did time-out access, and we talked about Azure Resource roles like owner, contributor, and so on. Because eligibility workflows are really easy to configure, I want to show you how to do both of these within the same Nugget.

0:35But first up, the very first step is choosing who you're going to be delegating this permission to. In my particular case, I want to be the one who's approving whenever my people get elevated. So I'm going to go to Azure Active Directory first. I'm going to choose my account under Users. I'll go ahead and give myself a click, and we're going to assign myself an Azure P2 license. Now, you can also do this with an EMS E5 license, as well. We'll go ahead and click Assign. We'll choose Products. We'll choose the Azure P2 license, Select, and choose Assign. There we go.

1:05The license was assigned that quickly. All right. Now we're ready to get back into the PIM portal and start configuring the approval workflow process. Let's start with Azure AD roles. In this particular case, once we click on Azure AD Roles, I'm going to click on Settings. And let's say when we go into Roles here, we want to configure the global administrator to go through an approval process. If we scroll down to Global Administrator, we'll give it a click, and the very last option, if you remember, was Require Approval. We'll click Enable here. And the selected approver is the last part that we have to configure. We'll click on this little section here, and we'll choose my account and click Select.

1:39OK. That's it. Once we've got this done, we'll click Save. And now whenever somebody goes to the eligibility process of elevating into the global admin role, my account will receive an email where I can click on a link to approve or deny their request. Now, that's it for the Azure AD. Let's jump back into the PIM portal and configure this for Azure Resources. So from the PIM portal, we'll click on Azure Resources this time. We'll click on the subscription. Now we'll click on Role Settings here. And let's say we want owner to go through this sort of process.

2:09Now, we talked about assignment recently. That was for time-bound access. But now we're talking about the activation process. So if we're assigning someone to be eligible instead of active, this is going to go through the approval workflow process. And the two items that we're interested in-- the very last two, require approval and who is the approver. Let's click on Edit. We'll scroll on down and say, check off the box that requires the approval to activate, and we'll go ahead and just search for my account again. Give it a click, Select, Update. That's it. That's all there is to configuring the approval workflow process.

2:42Now whenever somebody goes to elevate their account, we're going to receive an email that allows us to approve or deny their request. I hope this has been informative for you, and I'd like to thank you for viewing.