It seems that for PIM to be effective you would always need to "require approval" for each role. Is there any security benefit to PIM without using this feature? It would seem that if an account is compromised the bad actor could simply activate the role themself if no approval is required.
Thats true but i suppose the actor would still have to know PIM is in place and you can also isolate when a user could activate that role to certain times. Its definitely not fool proof in that regard but I know many businesses using it for compliance reasons. Tracking reasons for elevation is another big benefit in that sense too.
Thank you for the informative video, just would like to know what happens if MFA for a user is disabled in the Azure AD MFA settings and you have chosen to have MFA while activation. Will, it will ask to enroll for MFA, or will it fail?
This is a great question. After demoing it out, you are asked to register for MFA vs having it fail so that seems like what you would expect/want to happen.
hey, thank you for your video. I appreciate on your workload. But there is smth I m not most clear is about custom role . i cannnot find that option on my portal. Looking forwards for your reply.
If the custom role is built for a particular subscription, go to PIM > Azure Resource > select that subscription > Roles...here you will be able to see custom role to be assigned through PIM
Excellent video for PIM and access reviews. I appreciated the completeness of the demo.
Thanks Jim!
Thanks for the video. Precise and clear, thanks!
Glad it was helpful!
It seems that for PIM to be effective you would always need to "require approval" for each role. Is there any security benefit to PIM without using this feature? It would seem that if an account is compromised the bad actor could simply activate the role themself if no approval is required.
Thats true but i suppose the actor would still have to know PIM is in place and you can also isolate when a user could activate that role to certain times. Its definitely not fool proof in that regard but I know many businesses using it for compliance reasons. Tracking reasons for elevation is another big benefit in that sense too.
Thank you for the informative video, just would like to know what happens if MFA for a user is disabled in the Azure AD MFA settings and you have chosen to have MFA while activation. Will, it will ask to enroll for MFA, or will it fail?
This is a great question. After demoing it out, you are asked to register for MFA vs having it fail so that seems like what you would expect/want to happen.
Thank you so much for sharing!
you are very welcome!
hey, thank you for your video. I appreciate on your workload. But there is smth I m not most clear is about custom role .
i cannnot find that option on my portal.
Looking forwards for your reply.
Hey Linn, so the path would be in the Azure Active Directory Admin Center>Azure Active Directory>Roles and Administrators>+New custom role
If the custom role is built for a particular subscription, go to PIM > Azure Resource > select that subscription > Roles...here you will be able to see custom role to be assigned through PIM
Hello
How download the program
Hey there, not sure i understand your question
@@t-minus365
How do I download the Microsoft Azure ?
Does Microsoft Azure mean the same as Microsoft PIM?
@@saduhasan7928 🤣