Alright, let's cut through the usual Microsoft praise. Entra ID's PIM (Privileged Identity Management) is powerful, but the "just-in-time" admin access is where most teams screw it up. They either lock themselves out, create approval queues that nobody checks, or leave gaping security holes. I've set this up after wrestling with Salesforce's clunky permission sets and HubSpot's... well, nothing equivalent, really.
Here's a pragmatic, gotcha-filled guide for setting up JIT for your server admins (think Global Administrator, Privileged Role Administrator, etc.). This assumes you're not just clicking buttons but actually want it to work.
**Step 1: Stop Assuming Your Defaults Are Safe**
First, don't just enable PIM on a role. Go to **Privileged Identity Management > Microsoft Entra roles > Settings**. Select the role (e.g., Global Administrator). The critical part most miss:
* **Require approval to activate:** Turn this ON. But *do not* select just anyone as an approver. Pick a separate, trusted security group. If you make another Global Admin the approver, you've created a circular dependency nightmare.
* **Require Azure MFA:** Obviously yes. But remember, this doesn't override Conditional Access policies. If your CA blocks the country your sysadmin is vacationing in, they're locked out. Plan for break-glass.
* **Maximum activation duration:** This isn't a suggestion; it's a hard cutoff. For server admins, 8-12 hours is sane. They will complain. Ignore them.
**Step 2: Assigning Eligibility (Not Direct Membership!)**
This is the core "just-in-time" part. In PIM, you **Add assignments**.
* **Member type:** *Eligible*. Not *Active*. Active means they have the role 24/7, which defeats the whole purpose.
* **Assignment type:** *Eligible* or *Time-bound eligible* if it's for a contractor. Set a permanent end date for contractors; you will forget to revoke it.
* **The Gotcha:** Just because someone is *eligible* doesn't mean they can activate without the requirements you set in Step 1. Double-check the member's view.
**Step 3: The Activation Process (Where Things Break)**
When your admin needs the role, they go to **My Roles > Eligible roles**. They activate, triggering the approval and MFA. Here's the rub:
* Approval notifications can get lost in email. Use the **PIM Approval app** in Teams if your org lives there.
* The activation reason field is often blanked or filled with "need it." Enforce a policy to require a ticket number. You can't technically enforce format in Entra, but you can reject activations without it.
* Remember: Activation is for a *specific* role. Need another role? Another request. This isn't a one-click "god mode."
**Step 4: Audit, Audit, Audit (The Part Everyone Skips)**
Don't just set and forget. In **PIM > Audit history**, you'll see who activated what, when, and for how long. If you see the same person activating every day for "routine work," they're gaming the system and should probably be an *Active* member (with extra logging). The goal is *privileged* access, not daily driver access.
The biggest pitfall? Not having at least two break-glass *Active* Global Admins outside of PIM, stored with insane security. Because one day, your approval queue will be empty, your designated approver will be on a plane, and everything will be on fire. Microsoft's own docs hint at this, but it feels like they're whispering it.
been there, migrated that