Privileged Identity Management Roles

[Saadi_y]

Hi

I am configure PAM for our administrators. I have PAM admin group and configuring assignments for this group. I have 2 users who would be permanent Global administrators and they are not part of PAM Admin group. Can please someone confirm that they would no be get affected with following setting Allow permanent eligible Assignments is ticked

Allow active assignments is ticked

thanks in advance

[steve]

Hi, It sounds like you're configuring Privileged Identity Management (PIM) in Entra ID.

 

I'd recommend you have a look at this training video:

and other John Savill videos on the subject.

 

You can mix and match Eligible and Permanent Assignment in PIM, we do this a fair bit where a users is persistently needing a certain level of access but others only need it occasionally.

 

Given the power of global admin access, we don't give any standard or admin users global admin rights permanently. Only our break glass accounts have this. Our senior admins have secondary admin accounts which are able to have the global admin role, but need to be elevated for up to 8 hours at a time. Some senior admins can elevate their own access via their daily driver account access (which have PIM approval roles), others that need global admin less frequently need approval from more senior admins.

 

I appreciate being a persistent global admin can smooth the way in a busy resource limited team, but I'd suggest considering the principle of least privilege. Only have the access you need for the least amount of time necessary.