メニュー
Configure Microsoft Entra Privileged Identity Management to enforce just-in-time role activation, approval workflows, and access reviews for Azure AD privileged roles.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/xalgord/xalgorix --skill implementing-azure-ad-privileged-identity-managementコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SKILL.md を表示中
Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.
Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.
Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.
SOC 職業分類に基づく
| name | implementing-azure-ad-privileged-identity-management |
| description | Configure Microsoft Entra Privileged Identity Management to enforce just-in-time role activation, approval workflows, and access reviews for Azure AD privileged roles. |
| domain | cybersecurity |
| subdomain | identity-access-management |
| tags | ["azure-ad","pim","entra-id","just-in-time","privileged-roles","identity-governance","zero-trust"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"] |
Microsoft Entra Privileged Identity Management (PIM) provides time-based and approval-based role activation to mitigate risks from excessive, unnecessary, or misused access to critical resources. PIM replaces permanent (standing) privilege assignments with eligible assignments that require users to explicitly activate their role before use, with configurable duration, MFA enforcement, approval workflows, and justification requirements. This is a core component of Zero Trust identity governance in Microsoft environments.
Get-MgRoleManagementDirectoryRoleAssignmentSchedule should show assignmentType=Activated, not Assigned, for day-to-day admins.selfActivate without MFA/justification and confirm it is rejected; pull the PIM audit log and confirm every privileged action maps to an activation with approval; run the "too many global admins" and "outside PIM" alerts and confirm zero standing admins beyond break-glass.| Type | Behavior | Use Case |
|---|---|---|
| Eligible | User must activate the role before use; expires after configured duration | Day-to-day admin work |
| Active | Role is always active; no activation needed | Service accounts, break-glass accounts |
| Time-Bound | Either type with explicit start/end dates | Temporary project access, contractor access |
User with Eligible Assignment
│
├── Opens PIM portal → My Roles
│
├── Clicks "Activate" on the desired role
│
├── Provides justification and optional ticket number
│
├── Completes MFA challenge (if required)
│
├── [If approval required] → Notification sent to approvers
│ │
│ ├── Approver reviews and approves/denies
│ └── User notified of decision
│
├── Role activated for configured duration (e.g., 8 hours)
│
└── Role automatically deactivated when duration expires
Audit current permanent role assignments and determine which should be converted to eligible:
| Current Role | Permanent Holders | Action |
|---|---|---|
| Global Administrator | 2-3 admins | Convert to eligible, keep 1 break-glass active |
| Exchange Administrator | IT team | Convert all to eligible |
| Security Administrator | SOC team | Convert to eligible |
| User Administrator | Help desk | Convert to eligible |
| Application Administrator | DevOps | Convert to eligible |
Best practice: Maintain no more than 2 permanent Global Administrators (break-glass accounts).
For each Entra directory role, configure PIM settings:
Via Microsoft Entra Admin Center:
Activation Settings:
Assignment Settings:
Notification Settings:
import requests
# Acquire token for Microsoft Graph
def get_graph_token(tenant_id, client_id, client_secret):
url = f"https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token"
data = {
"grant_type": "client_credentials",
"client_id": client_id,
"client_secret": client_secret,
"scope": "https://graph.microsoft.com/.default"
}
response = requests.post(url, data=data)
return response.json()["access_token"]
# Create eligible role assignment
def create_eligible_assignment(token, role_definition_id, principal_id,
directory_scope="/", duration_hours=8):
url = "https://graph.microsoft.com/v1.0/roleManagement/directory/roleEligibilityScheduleRequests"
headers = {
"Authorization": f"Bearer {token}",
"Content-Type": "application/json"
}
body = {
"action": "adminAssign",
"justification": "PIM eligible assignment",
"roleDefinitionId": role_definition_id,
"directoryScopeId": directory_scope,
"principalId": principal_id,
"scheduleInfo": {
"startDateTime": "2025-01-01T00:00:00Z",
"expiration": {
"type": "afterDuration",
"duration": "P180D" # 180-day eligible window
}
}
}
response = requests.post(url, headers=headers, json=body)
return response.json()
# Activate a role (user self-service)
def activate_role(token, role_definition_id, principal_id, justification,
duration_hours=8):
url = "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignmentScheduleRequests"
headers = {
"Authorization": f"Bearer {token}",
"Content-Type": "application/json"
}
body = {
"action": "selfActivate",
"principalId": principal_id,
"roleDefinitionId": role_definition_id,
"directoryScopeId": "/",
"justification": justification,
"scheduleInfo": {
"startDateTime": None, # Now
"expiration": {
"type": "afterDuration",
"duration": f"PT{duration_hours}H"
}
}
}
response = requests.post(url, headers=headers, json=body)
return response.json()
Set up recurring access reviews to verify eligible assignments remain appropriate:
Enable PIM security alerts:
| Alert | Trigger | Action |
|---|---|---|
| Too many global admins | > 5 Global Admins | Review and reduce |
| Roles being assigned outside PIM | Direct role assignment | Investigate and convert to PIM |
| Roles not requiring MFA | Activation without MFA | Enable MFA requirement |
| Stale eligible assignments | Not activated in 90 days | Review and potentially remove |
| Potential stale service accounts | Active assignments not used | Investigate and decommission |