Entra ID PIM Operations — Cirius Group

Privileged Identity Management (PIM) is how Cirius Group enforces just-in-time (JIT) access to privileged roles across both Entra tenants. This runbook covers everything needed to administer PIM from first principles: concepts, day-to-day activation, assignment management, settings, access reviews, monitoring, and audit evidence.

Tenants

Tenant	Domain	ID	Purpose
PROD	ciriusgroup.com	d477c9f8	Internal users, staff, core IT
DDE	ciriusdde.com	ff1c5d68	Customer-facing AVD/published apps, Medicare

PIM is configured and active on both tenants. Settings, roles in scope, and approval requirements may differ between them — check the tenant you are working in before assuming any setting matches the other.

Concepts

Assignment Types

Eligible — The user has the right to activate the role on demand, but holds no permissions until they do. This is the default for all privileged roles at Cirius. The role is available for a defined duration (time-bound eligible) or indefinitely (permanent eligible, not time-limited but still requires activation). Activation requires MFA and a justification.

Active (time-bound) — The role is currently active. It was either activated from an eligible assignment and will expire automatically, or it was assigned as active directly by an administrator. An active assignment from PIM is scoped to the activation window (e.g., 4 hours) and drops automatically when it expires.

Permanent Active — The role is always active, no activation required, no expiry. This is reserved exclusively for break-glass accounts and should never be used for any other account. Break-glass accounts are excluded from PIM entirely — they hold permanent active roles outside the PIM system. Any break-glass account activity is a CRITICAL incident in SecOps. See runbooks/break-glass-procedure.md.

Activation Workflow

User navigates to PIM and selects an eligible role to activate.
PIM prompts for MFA (Conditional Access enforces this — compliant device + MFA).
User enters a justification string (mandatory at Cirius).
User selects activation duration (up to the configured maximum for that role).
If the role requires approval: PIM sends a notification to the designated approver. The role is not active until approved.
If no approval required: role activates immediately after MFA passes.
Role drops automatically when the activation window expires.

Conditional Access Integration

PIM activations are gated by Conditional Access. The relevant CA policies require:

MFA at activation time (a fresh MFA challenge, not cached)
Compliant device (Intune-enrolled, passing compliance policies)

If your device is not compliant or MFA fails, PIM activation will be blocked. Check runbooks/conditional-access-reference.md for policy details.

PIM Exclusion List

Certain accounts are excluded from PIM because they need always-on access or because MFA-based PIM is incompatible with their function (service accounts, break-glass). The full list is in compliance/pim-exclusion-list.md. Never add an account to PIM eligible if it is on that list — and never remove an account from that list without understanding why it is there and what compensating controls exist.

Accessing PIM

Portal Path

PIM is accessed through the Azure portal. The path is the same for both tenants — but you must be in the correct tenant context before navigating there.

Go to https://portal.azure.com
In the top-right corner, click your account name / avatar to open the account menu
Click Switch directory and select the tenant you want to work in
Navigate to: Entra ID → Identity Governance → Privileged Identity Management
- Or search "Privileged Identity Management" in the Azure portal search bar
You should see the PIM overview with quick links to My roles, My requests, Approve requests, and Roles

Alternatively, go directly to:

PROD: https://portal.azure.com/#view/Microsoft_Azure_PIMCommon/CommonMenuBlade/~/quickStart (in d477c9f8 context)
DDE: same URL, in ff1c5d68 context

Who Can Administer PIM

Only accounts holding Privileged Role Administrator or Global Administrator can manage PIM settings, assignments, and access reviews. At Cirius this means Rory. Kevin and Greg hold T1 Domain Admin rights limited to DR scenarios — they do not administer PIM settings, but they may activate eligible roles they have been assigned.

Roles Covered by PIM

The following roles are managed through PIM at Cirius. No one should hold permanent active assignments to these roles except break-glass accounts (which are not in PIM).

Role	Tenant(s)	Approval Required	Max Activation
Global Administrator	PROD, DDE	Yes (Rory approves)	4 hours
Privileged Role Administrator	PROD, DDE	Yes (Rory approves)	4 hours
Security Administrator	PROD	No	8 hours
Exchange Administrator	PROD	No	8 hours
SharePoint Administrator	PROD	No	8 hours
Intune Administrator	PROD	No	8 hours
User Access Administrator	PROD	No	4 hours
Contributor (sensitive subscriptions)	PROD, DDE	No	8 hours
Owner (sensitive subscriptions)	PROD, DDE	Yes (Rory approves)	4 hours

Adjust these if PIM settings change. The authoritative source is the per-role settings in the PIM portal, not this table.

Activating a Role

This is what Rory (or Kevin/Greg for their eligible roles) does when they need elevated access for a task.

Portal Steps

Go to PIM → My roles
Click Eligible assignments (not Active assignments)
Find the role you want to activate in the list
Click Activate on the right
On the Activate screen:
- Duration: Set how long you need the role. You can set any value up to the configured maximum for that role. Set only what you need — do not default to max.
- Reason / Justification: Write a specific justification. Include the task and a ticket reference if one exists. Good: "Investigating MFA failure for user jsmith — ticket SEC-1042." Bad: "Admin work." Justifications are logged and included in audit evidence.
- Scope: For subscription-scoped roles (Contributor, Owner), confirm the scope shown is the intended subscription.
Click Activate
Complete the MFA challenge that appears
If the role requires approval (Global Admin, Privileged Role Admin, Owner): you will see a pending status. Rory (as approver) will receive an email and a PIM notification. The role will not be active until approved.
If no approval required: the role is active immediately. A notification email is sent.

After Activation

Go back to My roles → Active assignments to confirm the role is listed and see the expiry time
Perform your task
When the timer expires, the role is removed automatically — you do not need to deactivate it manually (though you can if you finish early: click Deactivate on the active assignment)

Activating via Graph API (Scripted)

For scripted or automated activation — useful when working headlessly or in a pipeline that needs temporary elevated access.

bash

# Get an access token for the tenant you need (PROD example)
az login --tenant d477c9f8
TOKEN=$(az account get-access-token --resource https://graph.microsoft.com --query accessToken -o tsv)

# Get your user object ID
USER_ID=$(az ad signed-in-user show --query id -o tsv)

# Get the role definition ID for the role you want (Security Administrator example)
# You can look this up in the PIM portal under Roles → [role name] → Properties
ROLE_DEF_ID="194ae4cb-b126-40b2-bd5b-6091b380977d"  # Security Administrator

# Activate the role — duration in minutes (480 = 8 hours)
az rest --method POST \
  --url "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignmentScheduleRequests" \
  --headers "Authorization=Bearer $TOKEN" "Content-Type=application/json" \
  --body "{
    \"action\": \"selfActivate\",
    \"principalId\": \"$USER_ID\",
    \"roleDefinitionId\": \"$ROLE_DEF_ID\",
    \"directoryScopeId\": \"/\",
    \"justification\": \"Scripted activation for automated task — [describe task]\",
    \"scheduleInfo\": {
      \"startDateTime\": null,
      \"expiration\": {
        \"type\": \"AfterDuration\",
        \"duration\": \"PT480M\"
      }
    }
  }"

Replace ROLE_DEF_ID with the actual role definition ID from the PIM portal. Role definition IDs are GUIDs and are stable within a tenant.

Role Assignment Management

Adding a New Eligible Assignment

Who can do this: Rory only (Privileged Role Administrator or Global Administrator).

PIM → Entra ID roles (or Azure resources for subscription-scoped roles)
Click Roles and select the role to assign
Click Add assignments
On the Membership tab:
- Assignment type: Eligible (always — not Active unless you have a documented exception)
- Member: search for and select the user
On the Setting tab:
- Assignment starts: today or a future date
- Assignment ends: set an end date (preferred) or leave as permanent eligible. For contractor or temporary staff, always set an expiry. For permanent staff in roles they regularly use, permanent eligible is acceptable.
Enter a justification (logged for audit)
Click Assign

The user will receive an email notification that they have a new eligible assignment.

Removing an Eligible Assignment

PIM → Entra ID roles → Roles → select the role
Click Eligible assignments
Find the user, click the ellipsis (...) → Remove
Confirm removal

The user loses the ability to activate that role immediately. If they currently have the role active (activated within their activation window), the active session continues until it expires. If you need to terminate an active session immediately, also remove any current active assignment under Active assignments.

Extending an Expiring Assignment

PIM sends notifications before an eligible assignment expires (typically at 14 days and 1 day). Users can request an extension from My roles → Eligible assignments → Extend. Rory reviews and approves or denies the extension request in PIM → Approve requests.

To extend proactively as an admin:

PIM → Entra ID roles → Roles → select the role → Eligible assignments
Find the user → ellipsis → Extend
Set the new end date and submit

Assignment Type Guidelines

Situation	Use
Regular staff using a privileged role for IT work	Permanent eligible
Contractor or temporary staff	Time-bound eligible (set expiry = contract end date)
Break-glass accounts	Permanent active (outside PIM entirely)
DR personnel (Kevin, Greg) for DR scenarios	Eligible with expiry matching DR exercise window
Any non-break-glass account	Never permanent active

PIM Settings Configuration

Each role in PIM has its own settings that control activation behavior. These are configured per-role and apply to everyone with an eligible assignment.

Viewing Role Settings

PIM → Entra ID roles → Settings
Select a role from the list
Click Edit to modify

Settings Reference

Maximum activation duration — Maximum number of hours a user can request when activating the role. Cirius defaults:

Global Admin, Privileged Role Admin, Owner: 4 hours
Security Admin, Exchange Admin, SharePoint Admin, Intune Admin: 8 hours
Contributor: 8 hours

Require MFA on activation — Always ON for all roles at Cirius. This is enforced by Conditional Access as well; both layers should be active.

Require justification on activation — Always ON for all roles at Cirius. Users must enter a justification string before the activation proceeds.

Require approval to activate — ON for Global Administrator, Privileged Role Administrator, and Owner. Rory is the designated approver. For other roles, approval is not required (Rory is typically the only activator, so self-approval would be circular).

Approval configuration — When approval is required, set Rory's account as the approver under Approvers. If Rory is unavailable and an approval is stuck, a secondary approver should be configured (consider break-glass account access as the emergency fallback — see runbooks/break-glass-procedure.md).

Notification settings — Configure email notifications to alert on:

Role activation (send to role activator + admins)
Pending approval requests (send to approvers)
Eligible assignment changes (send to admins)

For Global Administrator activations, an alert is also generated in SecOps (see Monitoring section below). Do not disable email notifications — they feed the audit trail.

On activation, require (Azure AD Premium P2 feature):

Azure MFA: Enabled
Require ticket information: Optional — Cirius uses the justification field instead of a separate ticket field, but enabling this and including a ticket number is acceptable.

Access Reviews

PIM access reviews are the formal process for verifying that eligible assignments are still appropriate. This is a HIPAA and SOC2 control requirement.

Regulatory basis:

HIPAA §164.308(a)(3)(ii)(B) — Workforce clearance procedure: covered entities must implement procedures to determine that access of a workforce member to ePHI is appropriate.
SOC2 CC6.3 — Logical access controls are reviewed periodically to remove access that is no longer appropriate.

Creating an Access Review

PIM → Access reviews → New
Configure the review:
- Review name: e.g., "Q2 2026 Privileged Role Review — PROD"
- Start date: first day of the review period
- Frequency: Quarterly (for HIPAA/SOC2 at Cirius)
- Duration: 14 days (reviewers have two weeks to complete)
- Roles: select all roles in scope (all roles listed in the Roles table above)
- Scope: All eligible + active assignments
- Reviewers: Rory (Rory reviews all privileged role assignments)
- Self-review: Disable — Rory reviews everyone including himself; do not allow users to approve their own continued access.
- If reviewer doesn't respond: Deny (fail-closed)
- Notify reviewers: Yes
Click Start

Completing an Access Review

When an access review is active, Rory will receive email notifications.

PIM → Access reviews → select the active review
For each user and role combination:
- Approve: User still needs this role. Leave a brief reason (e.g., "Active IT engineer, role required for regular operations").
- Deny: User no longer needs this role. PIM will remove the eligible assignment after the review closes.
When all decisions are made, click Submit

After the review closes:

Denied assignments are removed automatically
Export the review results for audit (see Audit Evidence section)

Review Schedule

Review	Frequency	Timing
PROD privileged roles	Quarterly	Q1: Jan, Q2: Apr, Q3: Jul, Q4: Oct
DDE privileged roles	Quarterly	Same months as PROD
Subscription-scoped roles (Contributor, Owner)	Quarterly	Same cycle

Monitoring and Alerts

Entra Audit Logs — Where PIM Events Land

PIM events (activations, assignments, approvals) are written to Entra Audit Logs and forwarded to the central Log Analytics Workspace cirius-logging-law-central (ID: 5d76d1f2, in rg-logging-logs).

The relevant table is AuditLogs. PIM events have Category == "RoleManagement".

KQL — PIM Activations in the Last 7 Days

kql

AuditLogs
| where TimeGenerated > ago(7d)
| where Category == "RoleManagement"
| where OperationName in (
    "Add member to role completed (PIM activation)",
    "Add eligible member to role (PIM activation)"
  )
| extend
    InitiatedBy = tostring(InitiatedBy.user.userPrincipalName),
    TargetRole  = tostring(TargetResources[0].displayName),
    Justification = tostring(AdditionalDetails[?(@.key == "Justification")].value)
| project TimeGenerated, InitiatedBy, TargetRole, Justification, Result
| order by TimeGenerated desc

KQL — Role Activations Outside Business Hours (before 7am or after 8pm Pacific)

Pacific time is UTC-7 (PDT) or UTC-8 (PST). This query uses UTC-7 as a fixed offset — adjust during PST if needed, or use datetime_utc_to_local() if your LAW has local time configured.

kql

AuditLogs
| where TimeGenerated > ago(30d)
| where Category == "RoleManagement"
| where OperationName has "PIM activation"
| extend
    LocalHour    = hourofday(TimeGenerated - 7h),
    InitiatedBy  = tostring(InitiatedBy.user.userPrincipalName),
    TargetRole   = tostring(TargetResources[0].displayName)
| where LocalHour < 7 or LocalHour >= 20
| project TimeGenerated, LocalHour, InitiatedBy, TargetRole, Result
| order by TimeGenerated desc

Any result here warrants a second look. Off-hours activations are not automatically malicious (Rory works flexible hours) but should be reviewed for legitimacy. An unknown user activating a privileged role after midnight is an incident.

KQL — Role Activations from Outside Known IPs

Get the list of known IP ranges from compliance/conditional-access-reference.md and substitute into this query. The IP parsing below extracts the originating IP from the Audit log's additional details.

kql

let KnownIPs = dynamic(["203.0.113.0/24", "198.51.100.0/24"]);  // Replace with real CIDRs
AuditLogs
| where TimeGenerated > ago(30d)
| where Category == "RoleManagement"
| where OperationName has "PIM activation"
| extend
    InitiatedBy = tostring(InitiatedBy.user.userPrincipalName),
    TargetRole  = tostring(TargetResources[0].displayName),
    IPAddress   = tostring(InitiatedBy.user.ipAddress)
| where isnotempty(IPAddress)
| extend IsKnownIP = ipv4_is_in_any_range(IPAddress, KnownIPs)
| where not(IsKnownIP)
| project TimeGenerated, InitiatedBy, TargetRole, IPAddress, Result
| order by TimeGenerated desc

Alert — Global Administrator Activation

Any Global Administrator role activation triggers a CRITICAL alert. This is handled by the identity monitoring agent (agents/entra/) which watches for PIM activation events where the target role is Global Administrator.

The alert path:

Identity agent detects activation → posts finding to SecOps /api/incidents
SecurityAgent creates a CRITICAL incident
Rory receives email + SecOps notification

If you are Rory and you activated Global Admin yourself: acknowledge the incident in SecOps with a note referencing your justification. Do not suppress this alert class — if someone else activated Global Admin, that is the incident you want to know about.

Break-Glass Interaction

Break-glass accounts are entirely outside PIM. They hold permanent active Global Administrator roles directly — no activation required, no justification logged through PIM, no expiry.

This is intentional. Break-glass accounts exist for scenarios where PIM itself is inaccessible (Conditional Access misconfiguration, MFA provider outage, Entra API issues). If break-glass accounts were in PIM, you could not activate them during an Entra outage.

The compensating controls are:

Every break-glass login triggers an unsuppressible CRITICAL incident in SecOps
Break-glass accounts are in the exclusion list (compliance/pim-exclusion-list.md)
Break-glass account credentials are in Keeper, rotated annually, physical 2FA where supported
The SecOps API has a hard block preventing break-glass accounts from ever being added to known-good rules

Never:

Add a break-glass account to a PIM eligible assignment
Attempt to put break-glass accounts under PIM — this removes the emergency access guarantee
Assign any non-break-glass account a permanent active role without documented justification

If you see a break-glass account in PIM eligible assignments: This is a misconfiguration. Remove it immediately and investigate how it got there.

For break-glass activation procedures: runbooks/break-glass-procedure.md.

DDE Tenant Specifics

The DDE tenant (ciriusdde.com, tenant ff1c5d68) has a smaller role surface because its scope is narrower — primarily AVD session host management and the published app environment serving Medicare.

DDE PIM Scope

The roles in PIM for DDE are a subset of the PROD list. Roles not needed in DDE (e.g., Exchange Administrator, SharePoint Administrator) are not configured in DDE PIM. The roles that are active:

Global Administrator (DDE) — break-glass only, permanent active, outside PIM
Privileged Role Administrator (DDE) — Rory, eligible
Contributor on DDE subscription — Rory, eligible
Owner on DDE subscription — break-glass only, outside PIM

Switching Tenant Context

All PIM administration for DDE happens in the DDE tenant context. The portal does not merge PIM views across tenants — you will only see roles for the tenant you are currently in.

To switch:

Portal top-right → account menu → Switch directory
Select ciriusdde.com
Navigate to PIM normally

You can also open a second browser profile or InPrivate window signed into the DDE tenant to manage both simultaneously without constant switching.

DDE Change Sensitivity

DDE is a HIPAA-covered Medicare environment. Even though the privileged role surface is smaller, any changes in DDE carry higher regulatory sensitivity. Document DDE PIM changes with the same rigor as PROD, and ensure DDE access reviews are included in the quarterly cycle.

Audit Evidence

Auditors (SOC2, HIPAA) will ask for evidence that privileged access is managed with least-privilege, time-limited, and periodically reviewed. PIM generates all the raw evidence — this section explains how to extract and present it.

Relevant controls:

SOC2 CC6.3 — Access is reviewed periodically and removed when no longer appropriate
HIPAA §164.308(a)(3) — Access authorization and workforce clearance procedures

What an Auditor Wants to See

Current eligible assignments list — Who has what eligible roles right now
Activation history — Who activated what roles, when, with what justification, for how long
Access review results — Evidence that a human reviewed and approved or denied continued access, quarterly
Settings evidence — Screenshots or export showing MFA and justification requirements are enforced
Assignment changes — History of who was added to or removed from eligible roles

Exporting Current Eligible Assignments

PIM → Entra ID roles → Assignments
Filter to Eligible assignments
Click Download (CSV) — this gives a point-in-time snapshot
Repeat for Azure resources if subscription-scoped roles are in scope

Do this at the start and end of each audit period.

Exporting Activation History from LAW

kql

// PIM activation history for audit period
// Adjust date range to match audit window
AuditLogs
| where TimeGenerated between (datetime(2026-01-01) .. datetime(2026-03-31))
| where Category == "RoleManagement"
| where OperationName in (
    "Add member to role completed (PIM activation)",
    "Add eligible member to role (PIM activation)",
    "Remove member from role (PIM activation expired)"
  )
| extend
    InitiatedBy   = tostring(InitiatedBy.user.userPrincipalName),
    TargetRole    = tostring(TargetResources[0].displayName),
    Justification = tostring(AdditionalDetails[?(@.key == "Justification")].value),
    Duration      = tostring(AdditionalDetails[?(@.key == "Duration")].value)
| project TimeGenerated, OperationName, InitiatedBy, TargetRole, Justification, Duration, Result
| order by TimeGenerated desc

Export to CSV from LAW → Export or via the REST API. Save the CSV to SharePoint.

Exporting Access Review Results

PIM → Access reviews → select the completed review
Click Download → CSV
The CSV includes each reviewer decision, reason entered, and final outcome

Where Adriana Uploads These

SharePoint compliance library: the exact path should be coordinated with Adriana. The standard location at Cirius is the compliance document library used for SOC2/HIPAA audit packages. Adriana manages the upload — provide her the files after each quarterly review and at audit request time.

Evidence Package (per audit period)

Artifact	Source	Format
Eligible assignments (start of period)	PIM → Assignments → Download	CSV
Eligible assignments (end of period)	PIM → Assignments → Download	CSV
Activation history	LAW KQL export	CSV
Access review results	PIM → Access reviews → Download	CSV
Role settings screenshots	PIM → Settings → per-role screenshots	PNG or PDF

PIM Exclusion List

The file compliance/pim-exclusion-list.md is the authoritative list of accounts excluded from PIM requirements. This includes:

Break-glass accounts (permanent active, outside PIM — see above)
Service accounts where MFA-based PIM activation is operationally incompatible
Any other accounts with a documented, approved exception

For each exclusion, the file records the account, the reason for exclusion, and the compensating controls in place. If you add or remove an account from PIM consideration, update compliance/pim-exclusion-list.md at the same time.

The three-layer access architecture context is in compliance/three-layer-access-architecture.md. CA policy interactions are in compliance/conditional-access-reference.md.

Routine Tasks

Monthly

Review eligible assignments for staleness. Run this KQL to see all current eligible assignments and cross-reference against HR records:

kql

// This query requires Entra sign-in data — run in the tenant PIM portal or via Graph API
// Alternatively, export assignments from PIM → Assignments → Download and review the CSV

Manually: PIM → Entra ID roles → Assignments → Eligible → review the list. Ask:

Did anyone leave the organization? Remove their assignments immediately (offboarding runbook runbooks/employee-offboarding.md should have triggered this, but verify).
Has anyone changed roles and no longer needs a particular eligible assignment?
Are any assignments nearing expiry that need renewal decisions?

Quarterly

Run formal access review for all roles in scope (see Access Reviews section above).

After the review closes:

Export results (CSV)
Document any denied assignments and confirm PIM removed them
Send evidence package to Adriana for the compliance library
Note the review completion in the monthly security review (runbooks/monthly-security-review.md)

Annually

Re-evaluate PIM settings for each role.

For each role in PIM settings:

Is the maximum activation duration still appropriate? (e.g., is 8 hours too long for Exchange Admin given current usage patterns?)
Should any role move from no-approval to approval-required?
Are notification recipients current?
Do the roles in scope still match the actual privileged roles in use? Add newly created privileged roles; remove roles that are no longer used.

Document the review outcome and any changes made. Store in the compliance library.

Troubleshooting

PIM activation fails with "MFA required" error even after completing MFA.

The CA policy requires a fresh MFA claim issued during the PIM session. If you completed MFA earlier in your session, it may be stale. Sign out and sign back in to force a fresh authentication before attempting the PIM activation. If the device is not Intune-enrolled or out of compliance, PIM will block regardless of MFA — check device compliance in Intune first.

Approval request not received by approver.

Check PIM → Pending requests — confirm the request is listed. If it is listed but the approver did not receive an email, check the approver's spam folder and verify their email address is correct in the approver configuration (PIM → Settings → role → Edit → Approval tab). Rory can approve directly from the PIM portal without email if needed.

Role did not drop after activation window expired.

Active assignments from PIM expire automatically. If a role appears to still be active past its window, check My roles → Active assignments — the expiry time should be visible. If the expiry has passed but the role is still listed, refresh the page. If it persists, manually click Deactivate or contact Microsoft support — this is rare but can occur with transient Entra service issues.

User cannot see eligible assignments in My roles.

Confirm the eligible assignment was created for the correct user account and tenant. Assignments do not cross tenant boundaries. Also confirm the PIM license (Entra ID P2 or Microsoft 365 E3/E5) is applied to the user — users without a qualifying license cannot see PIM features.

Activation succeeds but permissions don't appear to work.

There can be a short propagation delay (typically under 5 minutes) between PIM activation and the permissions being enforced by the underlying service. Wait a few minutes and retry. If it persists after 15 minutes, check that the activation shows as Active in My roles → Active assignments and that the scope is correct (directory-wide vs. subscription-specific).

runbooks/break-glass-procedure.md — Break-glass account activation procedures
runbooks/entra-identity-operations.md — General Entra ID identity operations
runbooks/conditional-access-reference.md — CA policies including PIM gating policies
runbooks/employee-offboarding.md — Includes PIM assignment removal on offboarding
runbooks/monthly-security-review.md — Monthly review checklist references PIM
compliance/pim-exclusion-list.md — Accounts excluded from PIM with compensating controls
compliance/three-layer-access-architecture.md — Overall access control model
compliance/conditional-access-reference.md — CA policy documentation

Entra ID PIM Operations — Cirius Group ​

Tenants ​

Concepts ​

Assignment Types ​

Activation Workflow ​

Conditional Access Integration ​

PIM Exclusion List ​

Accessing PIM ​

Portal Path ​

Who Can Administer PIM ​

Roles Covered by PIM ​

Activating a Role ​

Portal Steps ​

After Activation ​

Activating via Graph API (Scripted) ​

Role Assignment Management ​

Adding a New Eligible Assignment ​

Removing an Eligible Assignment ​

Extending an Expiring Assignment ​

Assignment Type Guidelines ​

PIM Settings Configuration ​

Viewing Role Settings ​

Settings Reference ​

Access Reviews ​

Creating an Access Review ​

Completing an Access Review ​

Review Schedule ​

Monitoring and Alerts ​

Entra Audit Logs — Where PIM Events Land ​

KQL — PIM Activations in the Last 7 Days ​

KQL — Role Activations Outside Business Hours (before 7am or after 8pm Pacific) ​

KQL — Role Activations from Outside Known IPs ​

Alert — Global Administrator Activation ​

Break-Glass Interaction ​

DDE Tenant Specifics ​

DDE PIM Scope ​

Switching Tenant Context ​

DDE Change Sensitivity ​

Audit Evidence ​

What an Auditor Wants to See ​

Exporting Current Eligible Assignments ​

Exporting Activation History from LAW ​

Exporting Access Review Results ​

Where Adriana Uploads These ​

Evidence Package (per audit period) ​

PIM Exclusion List ​

Routine Tasks ​

Monthly ​

Quarterly ​

Annually ​

Troubleshooting ​

Related Documents ​

Entra ID PIM Operations — Cirius Group

Tenants

Concepts

Assignment Types

Activation Workflow

Conditional Access Integration

PIM Exclusion List

Accessing PIM

Portal Path

Who Can Administer PIM

Roles Covered by PIM

Activating a Role

Portal Steps

After Activation

Activating via Graph API (Scripted)

Role Assignment Management

Adding a New Eligible Assignment

Removing an Eligible Assignment

Extending an Expiring Assignment

Assignment Type Guidelines

PIM Settings Configuration

Viewing Role Settings

Settings Reference

Access Reviews

Creating an Access Review

Completing an Access Review

Review Schedule

Monitoring and Alerts

Entra Audit Logs — Where PIM Events Land

KQL — PIM Activations in the Last 7 Days

KQL — Role Activations Outside Business Hours (before 7am or after 8pm Pacific)

KQL — Role Activations from Outside Known IPs

Alert — Global Administrator Activation

Break-Glass Interaction

DDE Tenant Specifics

DDE PIM Scope

Switching Tenant Context

DDE Change Sensitivity

Audit Evidence

What an Auditor Wants to See

Exporting Current Eligible Assignments

Exporting Activation History from LAW

Exporting Access Review Results

Where Adriana Uploads These

Evidence Package (per audit period)

PIM Exclusion List

Routine Tasks

Monthly

Quarterly

Annually

Troubleshooting

Related Documents