top of page


  • Writer's pictureRoman Guoussev-Donskoi

Azure Privileged Identity Management: Simple Power of using Groups


Groups are one of the oldest techniques to scale identity management.

With the Azure PIM privileged access groups (preview), you can give workload-specific administrators quick access to multiple roles with a single just-in-time request. When the admins elevate into the group, they’ll become members of all Azure AD roles assigned to the group.

Additional details you can find on Microsoft documentation Management capabilities for Privileged Access groups (preview)


We found PIM privileged access groups capability very useful and added a layer to make it more flexible and believe better fit for larger enterprises. Specifically

  1. Use Azure Activity Directory Groups to manage groups of users (reflect organization structure)

  2. Use PIM Privileged access groups to group roles and privileges to be granted (functional roles)

  3. Assign Azure AD Groups to PIM Privileged access groups as eligible members (instead of assigning individual users directly to PIM groups)

This allows us:

  • Delegate access reviews of organizational AD Groups to managers of specific departments

  • Clearly identify what departments require functional roles configured in PIM Privileged access groups

  • Still leverage PIM audit history of users activating PIM groups membership


The setup if extremely simple as shown below

Create role-enabled Azure AD group to be used as PIM Privileged access groups

Grant required AD roles to group being created

You can check that the required roles have been added to the group

Enable PIM for the created group

The group will show now in PIM "Privileged access groups"

in Azure AD Groups blade create a new AAD group to represent the organizational department

Now go to Privileged Identity Management and add assignment to previously created PIM group

Select the AAD group representing organizational unit as a member of PIM group

Click Next

Make member AAD group Eligible and specify maximum duration of this assignment

Now can see department AAD group in the list of Eligible assignments for PIM group. And no direct user assignments.

Users assigned as members of department AD group now can activate PIM group (even though no users directly assigned to PIM group)

Users can check in PIM that group has been activated

User can also check in PIM "My roles" that roles granted to PIM Group are assigned to them via group activation

User can click on "Group" link in Activated Role record shown above to see what group activated this role

PIM administrator can also still see in PIM group "Resource Audit" that user has activated PIM group

That is all.

Now we can have access reviews of group membership done by department group managers and the same time PIM administrator produce audit history of privileged access.

In our case this i exactly what was needed and this approach is easy to tune to to match specific organizational requirements.

182 views0 comments

Recent Posts

See All

LLMs (such as OpenAI) are good for reasoning but they lack capability interface with outside world. This is where Langchain agents step in: agents provide LLMs with tools to perform actions (for examp

Summary Langchain framework makes building of LLM applications much easier, extends capabilities of LLM applications, and introduces structured approach, which facilitates supporting and managing app

Home: Blog2


Home: GetSubscribers_Widget


Your details were sent successfully!

Home: Contact
bottom of page