implementing-azure-ad-privileged-identity-management skill (Anthropic-Cybersecurity-Skills)

From Public Agent Wiki

What it does. Configure Microsoft Entra Privileged Identity Management (PIM) to convert Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Upstream mukul975/Anthropic-Cybersecurity-Skills
Skill file skills/implementing-azure-ad-privileged-identity-management/SKILL.md
License Apache-2.0 (skill folder LICENSE)
Author mukul975
Fetched 2026-09-10

Install

  • npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-azure-ad-privileged-identity-management, or copy the skill folder into ~/.claude/skills/implementing-azure-ad-privileged-identity-management/.
  • Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-azure-ad-privileged-identity-management/SKILL.md

SKILL.md (verbatim)

name: implementing-azure-ad-privileged-identity-management
description: Configure Microsoft Entra Privileged Identity Management (PIM) to convert
  standing privileged assignments into eligible, time-bound roles requiring justification,
  MFA, and approval, covering Entra roles, Azure resource roles, and PIM for Groups,
  plus access reviews. Use for role-assignment audits, just-in-time admin activation,
  or Zero Trust identity governance in Entra/Azure AD.
domain: cybersecurity
subdomain: identity-access-management
tags:
- azure-ad
- pim
- entra-id
- just-in-time
- privileged-roles
- identity-governance
- zero-trust
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.AA-01
- PR.AA-02
- PR.AA-05
- PR.AA-06
mitre_attack:
- T1078
- T1110
- T1556
- T1098
mitre_f3:
  version: '1.1'
  tactics:
  - initial-access
  - positioning
  - defense-impairment
  techniques:
  - id: F1006
    name: Account Takeover
    tactic: initial-access
    source: f3
  - id: T1110.003
    name: 'Brute Force: Password Spraying'
    tactic: initial-access
    source: attack
  - id: F1005
    name: Account Manipulation
    tactic: positioning
    source: f3
  - id: F1005.002
    name: 'Account Manipulation: Add Authorized User'
    tactic: defense-impairment
    source: f3

Implementing Azure AD Privileged Identity Management

Overview

Microsoft Entra Privileged Identity Management (PIM) provides time-based and approval-based role activation to mitigate risks from excessive, unnecessary, or misused access to critical resources. PIM replaces permanent (standing) privilege assignments with eligible assignments that require users to explicitly activate their role before use, with configurable duration, MFA enforcement, approval workflows, and justification requirements. This is a core component of Zero Trust identity governance in Microsoft environments.

When to Use

  • When deploying or configuring implementing azure ad privileged identity management capabilities in your environment
  • When establishing security controls aligned to compliance requirements
  • When building or improving security architecture for this domain
  • When conducting security assessments that require this implementation

Prerequisites

  • Microsoft Entra ID P2 or Microsoft Entra ID Governance license
  • Global Administrator or Privileged Role Administrator role
  • Azure subscription for Azure resource role management
  • MFA configured for all privileged users
  • Microsoft Authenticator or FIDO2 key for admin accounts

Core Concepts

Assignment Types

Type Behavior Use Case
Eligible User must activate the role before use; expires after configured duration Day-to-day admin work
Active Role is always active; no activation needed Service accounts, break-glass accounts
Time-Bound Either type with explicit start/end dates Temporary project access, contractor access

PIM Activation Flow

User with Eligible Assignment
        │
        ├── Opens PIM portal → My Roles
        │
        ├── Clicks "Activate" on the desired role
        │
        ├── Provides justification and optional ticket number
        │
        ├── Completes MFA challenge (if required)
        │
        ├── [If approval required] → Notification sent to approvers
        │       │
        │       ├── Approver reviews and approves/denies
        │       └── User notified of decision
        │
        ├── Role activated for configured duration (e.g., 8 hours)
        │
        └── Role automatically deactivated when duration expires

Supported Resource Types

  1. Microsoft Entra Roles: Global Admin, Exchange Admin, Security Admin, etc.
  2. Azure Resource Roles: Owner, Contributor, User Access Administrator on subscriptions/resource groups
  3. PIM for Groups: Manage membership in privileged security groups

Workflow

Step 1: Plan Role Assignments

Audit current permanent role assignments and determine which should be converted to eligible:

Current Role Permanent Holders Action
Global Administrator 2-3 admins Convert to eligible, keep 1 break-glass active
Exchange Administrator IT team Convert all to eligible
Security Administrator SOC team Convert to eligible
User Administrator Help desk Convert to eligible
Application Administrator DevOps Convert to eligible

Best practice: Maintain no more than 2 permanent Global Administrators (break-glass accounts).

Step 2: Configure Role Settings

For each Entra directory role, configure PIM settings:

Via Microsoft Entra Admin Center:

  1. Navigate to Identity Governance > Privileged Identity Management > Microsoft Entra roles
  2. Select "Settings" and choose the role to configure
  3. Configure the following:

Activation Settings:

  • Maximum activation duration: 8 hours (recommended; max 72 hours)
  • Require MFA on activation: Enabled
  • Require justification: Enabled
  • Require ticket information: Enabled (for change management integration)
  • Require approval: Enabled for Global Admin, Security Admin

Assignment Settings:

  • Allow permanent eligible assignment: No (set expiry)
  • Expire eligible assignments after: 6 months (requires re-certification)
  • Allow permanent active assignment: Only for break-glass accounts
  • Require MFA on active assignment: Enabled
  • Require justification on active assignment: Enabled

Notification Settings:

  • Send email when members are assigned eligible: Role assigners, admins
  • Send email when members activate: Admins, security team
  • Send email when eligible members activate roles: Role assignees

Step 3: Configure via Microsoft Graph API

import requests

# Acquire token for Microsoft Graph
def get_graph_token(tenant_id, client_id, client_secret):
    url = f"https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token"
    data = {
        "grant_type": "client_credentials",
        "client_id": client_id,
        "client_secret": client_secret,
        "scope": "https://graph.microsoft.com/.default"
    }
    response = requests.post(url, data=data)
    return response.json()["access_token"]

# Create eligible role assignment
def create_eligible_assignment(token, role_definition_id, principal_id,
                                directory_scope="/", duration_hours=8):
    url = "https://graph.microsoft.com/v1.0/roleManagement/directory/roleEligibilityScheduleRequests"
    headers = {
        "Authorization": f"Bearer {token}",
        "Content-Type": "application/json"
    }
    body = {
        "action": "adminAssign",
        "justification": "PIM eligible assignment",
        "roleDefinitionId": role_definition_id,
        "directoryScopeId": directory_scope,
        "principalId": principal_id,
        "scheduleInfo": {
            "startDateTime": "2025-01-01T00:00:00Z",
            "expiration": {
                "type": "afterDuration",
                "duration": "P180D"  # 180-day eligible window
            }
        }
    }
    response = requests.post(url, headers=headers, json=body)
    return response.json()

# Activate a role (user self-service)
def activate_role(token, role_definition_id, principal_id, justification,
                   duration_hours=8):
    url = "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignmentScheduleRequests"
    headers = {
        "Authorization": f"Bearer {token}",
        "Content-Type": "application/json"
    }
    body = {
        "action": "selfActivate",
        "principalId": principal_id,
        "roleDefinitionId": role_definition_id,
        "directoryScopeId": "/",
        "justification": justification,
        "scheduleInfo": {
            "startDateTime": None,  # Now
            "expiration": {
                "type": "afterDuration",
                "duration": f"PT{duration_hours}H"
            }
        }
    }
    response = requests.post(url, headers=headers, json=body)
    return response.json()

Step 4: Configure Access Reviews

Set up recurring access reviews to verify eligible assignments remain appropriate:

  1. Navigate to Identity Governance > Access Reviews > New Access Review
  2. Configure:
    • Review scope: Privileged Identity Management role assignments
    • Roles: Select all critical roles (Global Admin, Security Admin, etc.)
    • Reviewers: Managers or self-review with justification
    • Frequency: Quarterly for critical roles, semi-annually for others
    • Auto-apply results: Remove access for non-responsive reviews
    • Duration: 14 days for reviewers to respond

Step 5: Configure Alerts

Enable PIM security alerts:

Alert Trigger Action
Too many global admins > 5 Global Admins Review and reduce
Roles being assigned outside PIM Direct role assignment Investigate and convert to PIM
Roles not requiring MFA Activation without MFA Enable MFA requirement
Stale eligible assignments Not activated in 90 days Review and potentially remove
Potential stale service accounts Active assignments not used Investigate and decommission

Validation Checklist

  • All permanent privileged role assignments converted to eligible (except break-glass)
  • Break-glass accounts configured as active with monitoring alerts
  • MFA required for all role activations
  • Approval workflow configured for Global Administrator and Security Administrator
  • Maximum activation duration set to 8 hours or less for critical roles
  • Eligible assignments expire after 6 months (requires re-certification)
  • Justification and ticket information required for activations
  • Email notifications configured for role assignments and activations
  • Access reviews scheduled quarterly for all privileged roles
  • PIM alerts enabled and reviewed weekly
  • Audit logs forwarded to SIEM for monitoring

References

Other files in this skill

assets/template.md (verbatim)

Azure AD PIM Implementation Template

Tenant Details

Field Value
Tenant ID
Tenant Name
License Entra ID P2 / Entra ID Governance
Implementation Date
Project Lead

Role Configuration Matrix

Role Assignment Type Max Activation MFA Required Approval Required Approver
Global Administrator Eligible 1 hour Yes Yes
Security Administrator Eligible 4 hours Yes Yes
Exchange Administrator Eligible 8 hours Yes No
User Administrator Eligible 8 hours Yes No
Application Administrator Eligible 8 hours Yes No

Break-Glass Accounts

Account UPN Assignment MFA Storage Location
Break-Glass 1 Active Global Admin FIDO2 key
Break-Glass 2 Active Global Admin FIDO2 key

Migration Checklist

  • All permanent role assignments inventoried
  • Break-glass accounts identified and documented
  • PIM role settings configured for each role
  • Approval workflows configured with designated approvers
  • MFA enforced for all role activations
  • Permanent assignments converted to eligible (except break-glass)
  • Notification settings configured (admin, security team)
  • Access reviews scheduled (quarterly)
  • PIM alerts enabled and monitored
  • Audit logs forwarded to SIEM
  • User communication sent with activation instructions
  • Help desk trained on PIM troubleshooting

Access Review Schedule

Role Frequency Reviewer Auto-Apply Duration
Global Administrator Monthly Security Lead Yes - Remove 7 days
Security Administrator Quarterly CISO Yes - Remove 14 days
All Other Admin Roles Quarterly Manager Yes - Remove 14 days

references/api-reference.md (verbatim)

API Reference: Azure AD PIM Audit Agent

Dependencies

Library Version Purpose
requests >=2.28 HTTP client for Microsoft Graph API

CLI Usage

python scripts/agent.py \
  --tenant-id YOUR_TENANT_ID \
  --client-id YOUR_CLIENT_ID \
  --client-secret YOUR_SECRET \
  --output-dir /reports/ \
  --output pim_report.json

Functions

PIMClient(tenant_id, client_id, client_secret)

Authenticates via OAuth2 client credentials flow to Microsoft Graph API.

list_role_definitions() -> list

GET /roleManagement/directory/roleDefinitions - Available directory roles.

list_eligible_assignments() -> list

GET /roleManagement/directory/roleEligibilityScheduleInstances - PIM eligible roles.

list_active_assignments() -> list

GET /roleManagement/directory/roleAssignmentScheduleInstances - Active assignments.

list_role_settings() -> list

GET /policies/roleManagementPolicyAssignments - PIM policy configurations.

audit_permanent_assignments(active, eligible) -> list

Identifies permanent role assignments not managed via PIM eligible workflow.

compute_pim_coverage(active, eligible) -> dict

Calculates percentage of assignments managed through PIM.

Microsoft Graph Endpoints

Endpoint Purpose
POST /oauth2/v2.0/token Client credentials auth
GET /roleManagement/directory/roleDefinitions Role catalog
GET /roleManagement/directory/roleEligibilityScheduleInstances Eligible assignments
GET /roleManagement/directory/roleAssignmentScheduleInstances Active assignments

Output Schema

{
  "coverage": {"active_assignments": 15, "eligible_assignments": 42, "pim_coverage_pct": 73.7},
  "permanent_assignments": [{"role": "Global Administrator", "recommendation": "Convert to eligible"}],
  "recommendations": ["Convert 5 permanent assignments to PIM-eligible"]
}

references/standards.md (verbatim)

Azure AD PIM - Standards Reference

Microsoft Entra ID Licensing

Feature Required License
PIM for Entra Roles Entra ID P2 or Entra ID Governance
PIM for Azure Resources Entra ID P2 or Entra ID Governance
PIM for Groups Entra ID P2 or Entra ID Governance
Access Reviews Entra ID P2 or Entra ID Governance
Conditional Access Entra ID P1 (minimum)

Critical Entra Directory Roles

Role Risk Level Recommended PIM Setting
Global Administrator Critical Eligible, approval required, max 1hr activation
Privileged Role Administrator Critical Eligible, approval required
Security Administrator High Eligible, MFA required
Exchange Administrator High Eligible, MFA required
SharePoint Administrator High Eligible, MFA required
User Administrator Medium Eligible, MFA required
Application Administrator High Eligible, MFA required
Cloud Application Administrator High Eligible, MFA required
Intune Administrator Medium Eligible, justification required
Compliance Administrator Medium Eligible, justification required

Compliance Framework Mapping

NIST SP 800-53 Rev 5

  • AC-2(4): Automated Audit Actions (PIM audit logs)
  • AC-2(5): Inactivity Logout (time-bound activations)
  • AC-6(1): Authorize Access to Security Functions
  • AC-6(2): Non-Privileged Access for Non-Security Functions
  • AC-6(5): Privileged Accounts (eligible vs. active)

CIS Microsoft 365 Foundations Benchmark

  • 1.1.1: Ensure MFA is enabled for all users in admin roles
  • 1.1.3: Ensure that between two and four Global Admins are designated
  • 1.1.6: Ensure Administrative accounts are separate and cloud-only
  • 1.3.1: Ensure PIM is used to manage roles

SOC 2 Trust Service Criteria

  • CC6.1: Logical and physical access controls
  • CC6.2: Prior to issuing credentials, registration and authorization
  • CC6.3: Authorize, modify, or remove access timely

references/workflows.md (verbatim)

Azure AD PIM - Workflows

PIM Deployment Workflow

Phase 1: DISCOVERY
    ├── Export all permanent role assignments via Microsoft Graph
    ├── Identify users with multiple admin roles
    ├── Flag accounts without MFA enabled
    └── Document break-glass account strategy

Phase 2: PLANNING
    ├── Define activation settings per role (duration, MFA, approval)
    ├── Identify approvers for each critical role
    ├── Create communication plan for affected admins
    └── Schedule pilot group for initial rollout

Phase 3: CONFIGURATION
    ├── Configure PIM role settings (activation, assignment, notification)
    ├── Convert permanent assignments to eligible (except break-glass)
    ├── Configure conditional access policies for admin activation
    └── Enable audit logging and SIEM integration

Phase 4: TESTING
    ├── Test role activation with pilot users
    ├── Test approval workflow end-to-end
    ├── Test MFA enforcement during activation
    ├── Test auto-deactivation after duration expires
    └── Validate audit logs capture all PIM events

Phase 5: ROLLOUT
    ├── Convert remaining permanent assignments to eligible
    ├── Notify all affected users with activation instructions
    ├── Monitor for activation failures and help desk tickets
    └── Configure access reviews on quarterly schedule

Role Activation Workflow

Admin needs to perform privileged task
    │
    ├── Navigate to PIM portal (Entra Admin Center > PIM > My Roles)
    │
    ├── Click "Activate" on the needed role
    │
    ├── Select activation duration (up to configured max)
    │
    ├── Enter justification and optional ticket number
    │
    ├── Complete MFA challenge
    │
    ├── [If approval required]
    │   ├── Request submitted to approvers
    │   ├── Approvers receive email notification
    │   ├── Approver reviews justification and approves/denies
    │   └── Admin receives approval notification
    │
    ├── Role becomes active
    │
    ├── Admin performs required task
    │
    └── Role automatically deactivates when duration expires
        (or admin manually deactivates early)

Access Review Workflow

Quarterly Access Review Triggered
    │
    ├── PIM sends review notifications to designated reviewers
    │
    ├── For each eligible assignment:
    │   ├── Reviewer checks: Is this role still needed?
    │   ├── Reviewer checks: When was role last activated?
    │   ├── Decision: Approve (maintain), Deny (remove), or Don't know
    │   └── Provide justification for decision
    │
    ├── Review period expires (14 days default)
    │
    ├── Auto-apply results:
    │   ├── Approved assignments maintained
    │   ├── Denied assignments removed
    │   └── No-response: configurable (remove or maintain)
    │
    └── Review summary report generated for compliance

Break-Glass Account Workflow

Normal Operations:
    └── Break-glass accounts exist as ACTIVE Global Admin
        ├── Stored in secure physical safe (password printout)
        ├── Excluded from conditional access policies
        ├── Monitored by Azure Monitor alert rule
        └── Monthly verification: confirm no unauthorized sign-ins

Emergency Use:
    ├── Primary admin methods unavailable (MFA outage, PIM issue)
    ├── Retrieve break-glass credentials from safe
    ├── Sign in and resolve the emergency
    ├── Document all actions taken
    ├── Reset break-glass credentials after use
    └── Review and document in incident log

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.