Privileged Identity Management and Azure RBAC
Standing admin access is the most abused attack path. Azure RBAC decides what an identity can do on resources, and Microsoft Entra Privileged Identity Management (PIM) makes powerful roles temporary.
Azure RBAC basics
A role assignment is security principal + role definition + scope. Scope levels, from broad to narrow, are management group, subscription, resource group and resource. Assignments are inherited downward. Built-in roles to know: Owner (full access plus assigning roles), Contributor (full access but cannot assign roles), Reader, and User Access Administrator (manage access only).
Separate from these are Microsoft Entra roles (Global Administrator, Security Administrator, Global Reader and so on) that control the directory. Entra roles do not grant Azure resource access, although a Global Administrator can elevate access to manage all subscriptions.
Custom roles
A custom role is JSON with Actions, NotActions, DataActions, NotDataActions and AssignableScopes. Actions cover the management plane; DataActions cover data such as blobs or secrets. NotActions removes permissions from the allowed set, it is not an explicit deny. For a real block, use deny assignments (created by Azure Blueprints or managed applications) or resource locks (CanNotDelete, ReadOnly), which apply whatever the role.
Privileged Identity Management
PIM works for Entra roles, Azure resource roles and groups. It requires Microsoft Entra ID P2 (or ID Governance).
| Assignment type | Meaning |
|---|---|
| Eligible | The user must activate the role before using it |
| Active | The role is usable now, and can still be time-bound |
Role settings define maximum activation duration, whether justification, ticket information, MFA or approval is required, and who gets notifications. PIM also offers alerts, audit history and access reviews of privileged roles. The usual path: discover privileged access, convert permanent admins to eligible, then review regularly.
Access reviews
Access reviews are part of Microsoft Entra ID Governance. You pick the scope (group members, application assignments, role assignments, guests), the reviewers (selected users, group owners, or members reviewing themselves) and the recurrence. If reviewers do not respond you can apply a default action such as removing access.
Related delegation tools
- Administrative units limit an Entra role to a subset of users, groups or devices.
- Entitlement management bundles resources into access packages with approval and expiry.
- Azure Policy controls what resources may look like; it does not grant access.
Exam traps
- Contributor cannot assign roles; Owner and User Access Administrator can.
- NotActions is not a deny; a locked resource needs a lock or deny assignment.
- PIM needs P2, and eligible means activation is required.
- Azure RBAC roles and Microsoft Entra roles are different systems.
- Azure Policy is not a permissions mechanism.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. Administrators should hold the Contributor role on a subscription only for a few hours after they request it and give a reason. What do you use?
Show answer
Answer: B.An eligible assignment in PIM must be activated, and activation can require justification, MFA or approval and expires automatically.
2. User1 needs to create resources in resource group RG1 only. Which assignment follows least privilege?
Show answer
Answer: B.Roles are inherited downward, so assign the needed role at the narrowest scope that works. Reader cannot create resources.
3. You want resource owners to confirm every quarter that group members still need access. What do you configure?
Show answer
Answer: B.Access reviews (ID Governance) let owners, selected reviewers or users themselves recertify access and can remove it automatically.
4. A custom role lists Microsoft.Storage/* in Actions and Microsoft.Storage/storageAccounts/delete in NotActions. What can the user do?
Show answer
Answer: A.NotActions subtracts from Actions. It is not a deny; another role assignment could still allow the delete.