Edit

Implementing Privileged Identity Management (PIM) with RealmJoin Portal

Overview

This guide walks you through implementing Microsoft Entra ID Privileged Identity Management (PIM) for Groups with RealmJoin Portal administrative access. PIM provides just-in-time administrative access, reducing security risks by requiring users to activate their privileged roles when needed.

By implementing PIM with RealmJoin, administrators must explicitly activate their admin privileges for a defined time period, creating an audit trail and reducing the attack surface of persistent administrative access.

Prerequisites

  • Microsoft Entra ID P2 licensing for users requiring PIM access

  • Global Administrator or Privileged Role Administrator permissions

  • Access to RealmJoin Portal configuration

  • Understanding of Microsoft Entra ID Groups and role assignments

Implementation Steps

Step 1: Create Role-Assignable Groups

Create two security groups in Microsoft Entra ID. While the "role-assignable" attribute is no longer a strict prerequisite, it remains recommended for optimal PIM functionality.

Group 1: Eligibility Group

  • Name: sec - PIM-Eligibility - RealmJoin Portal - Admins

  • Purpose: Contains users eligible for RealmJoin admin access

  • Type: Security Group

  • Role-assignable: Recommended (Yes)

Group 2: Active Admin Group

  • Name: sec - PIM-Enabled - RealmJoin Portal - Admins

  • Purpose: The target group that provides actual RealmJoin admin permissions

  • Type: Security Group

  • Role-assignable: Recommended (Yes)

Step 2: Configure PIM for Groups

Enable PIM for Groups

  1. Navigate to Microsoft Entra ID > Privileged Identity Management

  2. Select Groups from the left navigation pane

  3. Choose Discover groups to identify groups eligible for PIM management

  4. Select your newly created groups to bring them under PIM control

For detailed configuration steps, refer to the official Microsoft documentation:

Configure Group Settings

  1. Set activation duration (recommended: 1-8 hours)

  2. Configure approval requirements if needed

  3. Define activation requirements (MFA, business justification)

  4. Set maximum activation duration policies

Step 3: Assign Eligibility

Configure user eligibility for the PIM-enabled group:

  1. In PIM, navigate to Groups > Assignments

  2. Select the sec - PIM-Enabled - RealmJoin Portal - Admins group

  3. Choose Add assignments

  4. Select Eligible assignment type

  5. Choose users or the eligibility group (sec - PIM-Eligibility - RealmJoin Portal - Admins)

  6. Set assignment duration and schedule as required

For comprehensive assignment guidance, see: Assign eligibility for a group in Privileged Identity Management

Configuration Logic

User Management Workflow

  1. Add Users to Eligibility Group: Add user accounts to sec - PIM-Eligibility - RealmJoin Portal - Admins

    • This group serves as the source of users who can request admin access

    • Users in this group can activate membership in the PIM-enabled group

  2. Configure RealmJoin Portal: Set sec - PIM-Enabled - RealmJoin Portal - Admins as the administrative group in RealmJoin Portal settings

    • Only active members of this group will have admin permissions

    • Users must activate their membership through PIM to gain access

Access Activation Process

When users need RealmJoin admin access:

  1. User navigates to My Access portal or PIM interface

  2. Requests activation of membership in sec - PIM-Enabled - RealmJoin Portal - Admins

  3. Provides business justification (if required)

  4. Completes MFA challenge (if configured)

  5. Receives time-limited admin access to RealmJoin Portal

  6. Access automatically expires after the defined duration

Security Benefits

  • Just-in-Time Access: Admin privileges are granted only when needed

  • Audit Trail: All activation requests and approvals are logged

  • Reduced Attack Surface: Fewer persistent admin accounts

  • Compliance: Supports regulatory requirements for privileged access management

  • Controlled Duration: Admin access automatically expires

  • Approval Workflows: Optional approval processes for sensitive roles

Best Practices

  • Regular Access Reviews: Periodically review group memberships and PIM assignments

  • Appropriate Duration: Set activation periods based on typical admin task duration

  • MFA Enforcement: Always require multi-factor authentication for activation

  • Business Justification: Require users to provide reasons for access requests

  • Monitoring: Regularly review PIM audit logs for unusual activation patterns

  • Documentation: Maintain clear procedures for emergency access scenarios

Troubleshooting

Common Issues

  • Users cannot see activation option: Verify PIM licensing and group assignments

  • Activation fails: Check MFA setup and approval workflow configuration

  • RealmJoin access denied: Confirm the correct group is configured in RealmJoin Portal settings

Verification Steps

  1. Test the activation process with a pilot user

  2. Verify RealmJoin Portal recognizes the PIM-enabled group

  3. Confirm audit logging is working correctly

  4. Test emergency access procedures

Additional Resources

Last updated

Was this helpful?