📖 What is Privileged Access Strategy?
A Privileged Access Strategy is a security framework designed to minimize the number of permanent administrators in a tenant. It emphasizes the use of 'least privilege' and 'just-in-time' access to reduce the attack surface for identity-based threats.
"When designing a strategy, prioritize the use of 'Eligible' assignments over 'Active' assignments to maximize security."
📚 Certification: Microsoft 365 Administrator (MS-102)
🔑 What are the Key Concepts of Privileged Access Strategy?
- ▸ Privileged Identity Management (PIM) is the primary tool used to manage, control, and monitor privileged access to Azure AD and M365 resources.
- ▸ Just-In-Time (JIT) access ensures users have administrative permissions only for the duration needed to complete a task, reducing the window of vulnerability.
- ▸ Eligible assignments require a user to activate their role, whereas Active assignments grant permanent permissions, which significantly increases the attack surface.
- ▸ The Principle of Least Privilege (PoLP) dictates that users should only be assigned the specific roles necessary for their function, avoiding over-provisioning.
- ▸ Access Reviews provide a mechanism to periodically validate that users still require their privileged roles, ensuring permissions are revoked when no longer needed.
🎯 How does Privileged Access Strategy appear on the MS-102 Exam?
You may be asked to recommend a configuration that prevents users from having permanent Global Administrator rights while still allowing them to perform admin tasks.
A scenario might describe a requirement where a user must provide a business justification and pass MFA before gaining access to a privileged role.
Expect questions regarding the auditing of privileged access, specifically how to track when a user activated a role and who approved the request.
❓ Frequently Asked Questions
Why should I prefer Eligible assignments over Active assignments?
Eligible assignments enforce an activation workflow, meaning the account lacks admin rights by default. This prevents attackers from using a compromised account to immediately perform administrative actions without passing activation hurdles.
Does a Privileged Access Strategy replace the need for separate admin accounts?
While PIM reduces the need for permanent roles, best practices still suggest using dedicated accounts for high-privilege tasks to completely isolate administrative activity from daily email and web browsing.