cirsec Baselines
Esc
Microsoft 365 tenant · Privileged access & administration

Grant highly privileged roles just in time through Privileged Identity Management

When it fails: Highly privileged roles are permanently active or assigned outside PIM. Standing privileged sessions give an attacker who steals an admin account immediate control, with no activation, justification or approval step.

CB-M365-ADMIN-006highactivemanualprofile baseline

Description

The roles in {{ highly_privileged_roles }} are only assigned as eligible in Microsoft Entra Privileged Identity Management (PIM): holders activate the role for a limited time when they need it. No active assignment is permanent, and the role settings forbid permanent active assignments. Assignments are made through PIM only, not directly in Roles & admins or by a third-party tool that bypasses PIM.

The emergency access accounts (CB-M365-ADMIN-002) are the only permanent active Global Administrators.

PIM settings are per role. Groups assigned to roles can be managed with PIM for Groups; their membership then follows the same rules.

Rationale

With just-in-time access, a stolen admin account has no privilege until the attacker manages to activate the role, which requires MFA, a justification and possibly an approval, and raises an alert. Activations are time-bound, so privileges disappear when the work is done. Assignments made outside PIM escape these settings and the PIM audit trail.

Impact

Administrators activate their role before each admin session, which adds a minute and needs MFA. Automation that relies on a user holding a role must move to a workload identity with the right application permissions. Every eligible user needs an Entra ID P2 (or ID Governance) license.

Applies when

Requires: Microsoft Entra ID P2

Parameters

ParameterBaselineHardenedBounds
highly_privileged_roleslist. Built-in roles that must never hold permanent active assignments.Global Administrator, Privileged Role Administrator, Privileged Authentication Administrator, Security Administrator, User Administrator, Exchange Administrator, SharePoint Administrator, Hybrid Identity Administrator, Application Administrator, Cloud Application AdministratorGlobal Administrator, Privileged Role Administrator, Privileged Authentication Administrator, Security Administrator, User Administrator, Exchange Administrator, SharePoint Administrator, Hybrid Identity Administrator, Application Administrator, Cloud Application Administrator

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

  1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
  2. Browse to ID Governance > Privileged Identity Management > Microsoft Entra roles > Assignments > Active assignments. For each role in the list, any active assignment with End time Permanent other than the emergency access accounts is a finding.
  3. Browse to Roles, open each role > Role settings: under Assignment, Allow permanent active assignment is No.
  4. Browse to Entra ID > Monitoring & health > Audit logs, filter on Category RoleManagement and Activity Add member to role: entries not initiated by MS-PIM show assignments made outside PIM.
  5. Read-only PowerShell alternative (Microsoft Graph, scope RoleManagement.Read.Directory): 
    Get-MgRoleManagementDirectoryRoleAssignmentScheduleInstance -All -ExpandProperty RoleDefinition |
  Where-Object { $_.AssignmentType -eq 'Assigned' -and -not $_.EndDateTime } |
  Select-Object PrincipalId, @{n='Role';e={$_.RoleDefinition.DisplayName}}
  6. Fail if a listed role has a permanent active assignment other than the emergency accounts, if permanent active assignment is allowed in its settings, or if assignments are made outside PIM.

Remediation

  1. With a Privileged Role Administrator, browse to ID Governance > Privileged Identity Management > Microsoft Entra roles > Roles, open each listed role > Role settings > Edit.
  2. Activation: maximum duration 8 hours or less, require MFA (or the phishing-resistant authentication context) and a justification.
  3. Assignment: set Allow permanent active assignment to No and Expire active assignments after to a short period.
  4. In Assignments > Active assignments, for each permanent assignment except the emergency accounts, select Update and change it to Eligible, or remove it and add an eligible assignment.
  5. Tell administrators to activate roles from My roles in PIM, and stop direct assignments in Roles & admins.
  6. Equivalent with Microsoft Graph: New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest to create the eligible assignment, then New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest -Action adminRemove to remove the active one.

Rollback

Convert the eligible assignment back to active in PIM with a Privileged Role Administrator or an emergency access account.

References

Mappings

FrameworkIDRelationNote
ANSSI - Recommandations relatives à l'administration sécurisée des systèmes d'information3.0R39partialCovers time-bound privilege on highly privileged Entra roles only.
NIST SP 800-53 Rev. 55.1.1AC-2(6)related
NIST SP 800-53 Rev. 55.1.1AC-6(5)related
CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0MS.AAD.7.4v1equivalent
CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0MS.AAD.7.5v1equivalent

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1078.004
MITRE ATT&CKT1098
  • related CB-M365-ADMIN-001 Use dedicated, named, cloud-only accounts for administrative roles
  • related CB-M365-ADMIN-002 Keep two protected emergency access accounts
  • related CB-M365-ADMIN-007 Require approval to activate the Global Administrator role
  • related CB-M365-ADMIN-008 Require approval to activate the Privileged Role Administrator role
  • related CB-M365-ADMIN-009 Alert on assignment and activation of highly privileged roles
  • related CB-M365-ADMIN-010 Review privileged role assignments periodically
  • related CB-M365-ADMIN-011 Remove unused and orphaned privileged role assignments
  • related CB-M365-ADMIN-014 Protect groups that grant privileges or bypass security policies
  • related CB-M365-ADMIN-018 Keep Global Administrator elevated access to Azure resources turned off
  • related CB-M365-AUDIT-012 Restrict who can read, disable or shorten Microsoft 365 audit logs

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr