As part of our mission to enable customers to manage access with least privilege, we’re excited to announce the general availability of two additions to Microsoft Entra Privileged Identity Management (PIM): PIM for Groups and PIM integration with Conditional Access.
Just-in-time access to privileged roles with PIM for groups
Part of Microsoft Entra ID Governance and Microsoft Entra ID P2, PIM enables you to manage just-in-time access to privileged roles in Microsoft Entra, Microsoft 365 services, and Azure.
With the new just-in-time group membership capability, you can now further simplify least privilege access by enabling just-in-time access for all resources that support security group or Microsoft 365 group assignments. This includes support for a wide range of roles such as Microsoft Entra roles, Azure resource roles, Microsoft Intune and non-Microsoft application roles and services. IT admins, developers, and security experts can now activate group membership once and have access to all defined resources precisely when needed to do their job.
PIM for Groups supports:
- Just-in-time group membership and ownership. Members get access to various resources through the group membership, while owners can manage group properties such as membership.
- Role-assignable and non-role-assignable groups, which removed the previous limit of 500 groups managed in PIM.
- Security and Microsoft 365 group types.
Learn more about PIM for Groups: Privileged Identity Management (PIM) for Groups - Microsoft Entra | Microsoft Learn
Enforce security requirements for activation using PIM integration with Conditional Access
Conditional Access authentication context allows you to apply granular policies to sensitive data and actions, going beyond app-level policies. By combining PIM with Conditional Access, you can now enforce specific requirements for PIM role activations, enhancing your security posture. During public preview, customers have leveraged this integration for various scenarios, such as:
- Requiring strong modern authentication methods, using Conditional Access Authentication Strengths.
- Requiring a compliant device for role activation.
- Validating the user’s location through GPS-based named locations.
- Blocking activation for risky users using Microsoft Entra ID Protection.
The PIM and Conditional Access integration is available for all providers: PIM for roles, PIM for Azure resources, and PIM for groups.
Configure authentication context requirements within PIM policies:
Eligible users must meet verification requirements during role:
Check out the documentation to learn more about Conditional Access authentication context.
Learn more about configuring Conditional Access authentication context in PIM settings at the links below:
- Configure Azure AD role settings in PIM - Microsoft Entra | Microsoft Learn
- Configure Azure resource role settings in PIM - Microsoft Entra | Microsoft Learn
- Configure PIM for Groups settings (preview) - Microsoft Entra | Microsoft Learn
- Discover all of the features in Microsoft Entra ID Governance
Joseph Dadzie
Partner Director of Product Management
LinkedIn: @joedadzie
Twitter: @joe_dadzie
Learn more about Microsoft Entra:
- Related Articles:
Explore New Product Announcements for Microsoft Entra
Microsoft Entra new feature and change announcements - See recent Microsoft Entra blogs
- Dive into Microsoft Entra technical documentation
- Join the conversation on the Microsoft Entra discussion space and Twitter
- Learn more about Microsoft Security