Microsoft Entra Privileged Identity Management

azure Policy engineazure-privileged-identity-management

Time-based and approval-based activation of eligible Entra, Azure resource and group roles.

Provider: azure
Kind: Policy engine
Category: Operations
Official docs: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure
Also known as: PIM

Properties · 3 set by this component

property	type	values	required	kind default	this component
activationMaxDurationHours · component property	integer	—	no	—	inherited
approvalRequired · component property	boolean	—	no	—	inherited
assignmentType · component property	enum	eligible \| active	no	—	inherited
effect	enum	audit \| deny \| modify \| deploy-if-not-exists	no	—	▸ modify
enforcementMode	enum	enforced \| disabled	no	—	▸ enforced
justificationRequired · component property	boolean	—	no	—	inherited
managed	boolean	—	no	false	▸ true
managedScope · component property	enum	entra-roles \| azure-resource-roles \| groups	no	—	inherited
mfaOnActivation · component property	boolean	—	no	—	inherited
policyCount	integer	—	no	—	inherited
remediation	boolean	—	no	false	inherited
scope	enum	resource \| group \| account \| organization	no	—	inherited

Rules that apply · 0

Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.

No rule reads this kind yet. That is a gap, not a guarantee.

Use it in a design

nodes:
  - { id: "privileged-identity-management", component: "azure-privileged-identity-management" }

Other Policy engine products · 56

Cloud Configalibaba-cloud-configalibabacloudpolicy-engine Data Security Centeralibaba-data-security-centeralibabacloudpolicy-engine Amazon CodeGuru Revieweraws-codeguru-reviewerawspolicy-engine AWS Configaws-configawspolicy-engine AWS Control Toweraws-control-towerawspolicy-engine IAM Access Analyzeraws-iam-access-analyzerawspolicy-engine AWS Lake Formationaws-lake-formationawspolicy-engine AWS License Manageraws-license-managerawspolicy-engine AWS Organizationsaws-organizationsawspolicy-engine AWS Resource Access Manageraws-ramawspolicy-engine Amazon Verified Permissionsaws-verified-permissionsawspolicy-engine Microsoft Entra Conditional Accessazure-conditional-accessazurepolicy-engine Azure Policyazure-policyazurepolicy-engine Cloudflare Data Loss Preventioncloudflare-dlpcloudflarepolicy-engine CalypsoAIcalypsoaipolicy-engine Cerboscerbospolicy-engine OPA Gatekeepergatekeeperpolicy-engine Guardrails AIguardrails-aipolicy-engine HiddenLayer AI Security Platformhiddenlayerpolicy-engine KubeArmorkubearmorpolicy-engine Kubewardenkubewardenpolicy-engine Kyvernokyvernopolicy-engine Lakera Guardlakera-guardpolicy-engine LLM Guardllm-guardpolicy-engine NeMo Guardrailsnemo-guardrailspolicy-engine Open Policy Agentopapolicy-engine Permit.iopermit-iopolicy-engine Generic policy enginepolicy-enginepolicy-engine Prompt Securityprompt-securitypolicy-engine Protect AIprotect-aipolicy-engine Rebuffrebuffpolicy-engine Robust Intelligencerobust-intelligencepolicy-engine SonarQube Serversonarqubepolicy-engine DigitalOcean CSPMdigitalocean-cspmdigitaloceanpolicy-engine Access Context Managergoogle-access-context-managergcppolicy-engine Assured Workloadsgoogle-assured-workloadsgcppolicy-engine Binary Authorizationgoogle-binary-authorizationgcppolicy-engine Identity and Access Managementgoogle-cloud-iamgcppolicy-engine Firebase App Checkgoogle-firebase-app-checkgcppolicy-engine Model Armorgoogle-model-armorgcppolicy-engine

and 16 more → Policy engine page

Source

1# yaml-language-server: $schema=../../schema/component.schema.json
2# Microsoft Entra Privileged Identity Management: time-based and approval-based role activation over
3# Microsoft Entra roles, Azure resource roles and groups ("What is Privileged Identity Management?").
4# An eligible assignment grants nothing until it is activated; "Configure Microsoft Entra role settings
5# in PIM" presents MFA, justification, ticket and approval as settings an administrator turns on and
6# states no default for any of them, and caps activation duration at one to 24 hours, so none is defaulted here.
7schemaVersion: "1"
8type: "component"
9id: "azure-privileged-identity-management"
10kind: "policy-engine"
11provider: "azure"
12docs: "https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure"
13aliases: ["PIM"]
14defaults:
15  managed: true
16  effect: "modify"
17  enforcementMode: "enforced"
18properties:
19  managedScope:
20    type: "enum"
21    values: ["entra-roles", "azure-resource-roles", "groups"]
22  assignmentType:
23    type: "enum"
24    values: ["eligible", "active"]
25  approvalRequired:
26    type: "boolean"
27  justificationRequired:
28    type: "boolean"
29  mfaOnActivation:
30    type: "boolean"
31  activationMaxDurationHours:
32    type: "integer"

The same page as markdown, for an agent: /catalogue/components/azure-privileged-identity-management.md