Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community
SOLVED

Azure PIM role settings

Iron Contributor

Hello

 

if a service account is already permanently active in a role , if this box is not checked will it move the service account to eligible?

 

Skipster3111_0-1638827924431.png

 

7 Replies
If it is a service account I would suggest to select allow permanent active assignment or
Hi @Skipster311-1,

The below answer won't directly answer your question, but It might help you boost your security.

Is there a possibility of requesting the application owner migrate the Service Account into a Service Principal? Most of the time, this is possible. However, I would not recommend using Service Accounts (especially) in the Cloud because of security purposes. Which automatically means I would never assign a permanent Azure AD role to the Service Account. There is an exception; If you could block the sign-in for this particular Service Account from any location except the trusted ones with Conditional Access, then it might be some sort of "safe," but still - Service Principals over (synced) Service Accounts.

Reasons for using a Service Principal:
- Doesn't exist of a username and password
- Cannot be logged in interactively from, for example, a portal page
- Less likely to be impacted when it comes to brute force attacks, isn't

I hope it will help you.
Good advice. Thank you. Can you point me to an article on how to create and use service principals ?
Thanks @Bilalehadd its a great let me take this advise any URL will be helpful
Can i also place the shared secret or certificate for the service principal in Azure key vault and then call the credentials that are in key vault instead of specifying the credentials for the service principal in code ?
best response confirmed by Skipster311-1 (Iron Contributor)
Solution

@Skipster311-1 @Chandrasekhar_Arya

See the below article, and as mentioned earlier, try to involve the application owner or supplier when you want to start implementing this.
https://identity-man.eu/2021/03/19/service-principals-all-you-need-to-know/

This is great , thanks!
1 best response

Accepted Solutions
best response confirmed by Skipster311-1 (Iron Contributor)
Solution

@Skipster311-1 @Chandrasekhar_Arya

See the below article, and as mentioned earlier, try to involve the application owner or supplier when you want to start implementing this.
https://identity-man.eu/2021/03/19/service-principals-all-you-need-to-know/

View solution in original post