Just-in-time access to groups and Conditional Access integration in Privileged Identity Management

Peter_Holdridge PIM was powerful feature even before this release, but it was limited to either Microsoft Entra roles (Azure AD roles) or Azure resources. Now, with PIM for Groups, you can use PIM as just-in-time system for variety of services - Microsoft and 3rd party - based on groups. This allows you to use PIM in many new scenarios.

Speaking about Conditional Access integration - yes, you could have per-app or tenant-wide policies in the past already. Now you can apply CA policies for activation of selected roles in PIM, which is more granular control compared to per-tenant setting.

This might be on the roadmap but I find myself opting away from these PIM dedicated groups because they don't support nesting. It gets confusing to have to create another security group also dedicated for storing access for nesting purposes. If these PIM/Role groups were able to have the same features as regular azure security groups (AD writeback/nesting, dynamic) it would be a no brainer and really a great tool for governance.

tkirwan in the past PIM supported only role-assignable groups, and role-assignable groups can't have other groups nested inside them.

Today, PIM supports both role-assignable and non-role-assignable groups. Also, one group can be an eligible member of another group, even if one of those groups is role-assignable.

Please find more details about PIM and group nesting in this article: https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/concept-pim-for-groups#privileged-identity-management-and-group-nesting

Dean_Gross only RBAC systems supported in PIM natively today are Azure roles and Microsoft Entra roles (previously known as Azure AD roles).

With PIM for Groups, you can provide users with just-in-time membership in the group, which in turn can provide access to other services. We are working on reducing activation delays so that PIM for Groups will provide access to Purview roles faster.

I must admit, I fail to see a lot benefits of this while staying secure. Is this just a minor enhancement?

We already have per-role activation in PIM which is more secure than activating all roles/access to resources.

We already have per-app conditional access policies for sign-in.

We already have MFA requirements for signing in. Do we need more controls for activating too?

Joseph Dadzie this is going to help several of my clients. But what about the numerous Purview roles that are not available in PIM, when will those roles get this functionality?

Dean_Gross Thats the beauty of PIM Groups - the Purview Roles do not have to be onboarded in PIM. You just PIM Enable the Groups that you assigned the Purview Role to.

Once a User has lost active access to the group, that change will be replicated to Purview. The user will only be an admin again once he has reactivated the Group. We use this for Exchange RBAC Roles not in PIM - However the Sync Cycles can be very difficult, since it can take hours for Group Memberships to be Replicated to the "Peripheral" Microsoft Solutions (Or in some Usecases through SCIM / Cross Tenant) - however those delays are Improving, and if JIT Access is a must these are issues you learn to live with.

I might be biased, since I got used to Security Admin Replication Times to Defender for Identity...

Ilya_Lushnikov Thanks, I guess my real question is how come the Purview roles are not included in the Azure AD roles like the many other roles from M365

Dean_Gross certain Microsoft Entra roles have permissions to manage different aspects of Purview. For example, Compliance Administrator role, Customer LockBox Access Approver, and other roles. More details: Microsoft Entra built-in roles - Microsoft Entra | Microsoft Learn

Having that said, service like Purview can also have it's own role system as well. Same is true for other M365 services - Intune, Exchange, etc.
With PIM for Groups, you can use PIM to provide just-in-time access for roles in variety of services, beyond just Microsoft Entra roles.

Interested in using PIM groups to control Owner privileges on SharePoint Online sites. When testing, it seems to work, but takes up to 30 minutes for the activated group to be recognized by SharePoint online. Any ideas on how to speed this up?