Key Points
- Set up PIM in Entra Admin Center: Enable PIM, assign roles as Eligible, configure activation duration, require MFA and approval, and define the scope for controlled privilege management.
- Role activation policies: Define MFA, justification, approval requirements, activation duration, and notification settings, ensuring all changes are auditable in Entra logs for accountability.
- PowerShell integration for JIT access: Use Microsoft Graph or the Azure AD PowerShell module to automate time-bound role assignments, enablingintegration with ticketing or service request workflows.
- Local Enforcement via Registry and GPO: Configure Group Policy and Registry settings to enforce least-privilege principles, deny unnecessary access, and require UAC prompts for elevated tasks.
- Auditing and alerting practices: Use audit logs and SIEM tools to monitor role activations, detect suspicious use of privileges, and alert on unusual JIT activity or failed MFA attempts.
Just-in-Time (JIT) administrative access in Azure AD gives you the ability to grant elevated privileges to perform administrative tasks for a limited duration. This is useful for internal IT teams and MSPs, as it reduces the risk of over-privileged accounts being used in cyberattacks.
This guide discusses Azure JIT administrative access and provides steps for implementing time-bound administrative access through Microsoft Entra ID Privileged Identity Management (PIM), using the Entra Admin Center, PowerShell, and the Registry or Group Policy for enforcement.
Key goals of Azure JIT access
Persistent admin access, the use of user accounts with permanent administrative privileges, is a frequent vector for attacks. Reducing the number of these privileged attacks reduces the attack surface area as fewer accounts could have their credentials leaked or sessions hijacked, making your IT infrastructure more secure and compliant.
Time-limited elevation protects against this by granting users administrative privileges only after approval and multifactor authentication. When the task is complete, the user’s administrative privileges expire, meaning their account cannot be used to attack or for any other unauthorized administrative activity.
The goals when configuring Azure JIT access using Microsoft Entra Privileged Identity Management should include minimizing standing admin rights, requiring justification and MFA approval before elevation, auditing all administrative activity, and automatically revoking administrative rights. JIT access should also be used alongside other security best practices, such as conditional access and alerting.
Prerequisites for using Microsoft Entra ID Privileged Identity Management
To use PIM, you’ll need:
- An Azure AD Premium P2 license (required for PIM)
- Global Administrator or Privileged Role Administrator rights to configure PIM
- Microsoft Entra ID Admin Center or PowerShell for configuration
- Optionally, a SIEM or RMM platform for monitoring, alerting, and configuration deployment
- Windows endpoints enrolled in Intune or monitored via RMM for policy enforcement
Enabling PIM and assigning eligible roles in Microsoft Entra ID Admin Center
To begin, you need to enable PIM and assign roles in the Microsoft Entra ID Admin Center:
- Go to Microsoft Entra Admin Center.
- Navigate to Identity Governance > Privileged Identity Management.
- Select Microsoft Entra roles.
- Choose a role (e.g., Global Administrator or Exchange Administrator).
- Click Add assignments.
- Set the user as “Eligible” for time-limited privileges.
- Define scope (e.g., tenant-wide or specific resource).
- Configure role settings separately to define activation duration (e.g., 1–24 hours).
- Enable Require approval and Require MFA as needed during activation settings.
Users must explicitly activate roles, and their access expires automatically. It is recommended to require approval and MFA for the best security.
Configuring role activation policies
Within PIM, you can configure the policies that govern how roles are activated. Policies include:
- Whether MFA is required
- Whether justification is required
- Whether approval is required (you can additionally specify which users can perform approvals)
- Activation duration (e.g., 1–8 hours)
- Notification settings
These can be configured in the Entra Admin Center by selecting a role, then navigating to Settings > Role settings
Requiring ticket numbers or case IDs as justification fields is a common practice. All configuration changes are auditable in the Entra logs.
Using PowerShell to manage JIT assignments
You can also use the Microsoft Graph or the Azure AD PowerShell module to assign roles programmatically, ideal for integration with service requests or automated ticket workflows that grant scoped access.
- To do this, connect to Microsoft Graph with the command:
Connect-MgGraph -Scopes “RoleManagement.ReadWrite.Directory”
- Then, list roles and role IDs:
Get-MgRoleManagementDirectoryRoleDefinition
- To create a time-bound role assignment for a user,run the following:
$params = @{
Action = “adminAssign”
PrincipalId = $userId
RoleDefinitionId = $roleId
DirectoryScopeId = “/”
Justification = “Granting temporary access”
ScheduleInfo = @{
StartDateTime = (Get-Date).ToUniversalTime().ToString(“yyyy-MM-ddTHH:mm:ssZ”)
Expiration = @{
Type = “AfterDuration”
Duration = “PT4H” # ISO 8601 format for 4 hours
}
}
}
New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest -BodyParameter $params
- Manually activate the role manually via Microsoft Entra Portal (optional).
Registry and Group Policy enforcement for local policy alignment
Although JIT is cloud-based, local systems should be configured for a least-privilege posture and implement auditing.
For example, you can use the Group Policy Object (GPO) located at Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment to Deny access to this computer from the network for specified users or groups. This setting restricts those accounts from using the network logon right, but it does not restrict all forms of remote connection.
The Windows Registry can also be used to enforce hardened defaults for elevation behavior, such as requiring UAC prompts. For example:
- EnableLUA = 1 ensures that User Account Control (UAC) is enabled.
- ConsentPromptBehaviorAdmin = 1 configures UAC so that administrators in Admin Approval mode are prompted for consent when performing operations that require elevation. However, this does not mean all administrative actions will always prompt. It specifically applies to elevation scenarios.
These configurations strengthen your local security posture. However, they do not directly enforce MFA or prevent MFA bypass. MFA enforcement should always be managed via platforms such as Microsoft Entra ID.
Auditing and alerting on JIT activity
Audit logs should be used to track role activation and access behavior.
Below is an example PowerShell query for retrieving audit log entries:
Search-UnifiedAuditLog -StartDate (Get-Date).AddHours(-24) -EndDate (Get-Date) -Operations “Add member to role” | Select-Object CreationDate, UserIds, Operations, AuditData
In Microsoft Entra audit logs, filter for “Add member to role” and “Update role assignment” operations to track activation events. If you also monitor on-premises Active Directory, Event IDs 4670 and 4688 are useful there. However, they do not capture cloud-based Entra ID PIM role activations.
You can then send these logs to your RMM or SIEM for alerting and reporting.
You should use log analytics or SIEM to alert on frequent activations, role elevation outside expected hours, and failed/repeated elevation requests.
Additional considerations for JIT and PIM
When configuring Azure JIT access in PIM, you should also consider your workflows and user-roles: users with the ability to approve elevation requests should be chosen carefully, and fully understand the implications of each request, while custom roles with limited scopes should be created, avoiding global administrative accounts, and recognizing the principle of least privilege.
Regularly review roles remove roles that are no longer required. The cleanup of roles and assignments should be incorporated into staff onboarding and offboarding procedures.
Troubleshooting Azure Just-in-Time access
If your Azure JIT implementation is not functioning as expected, be sure to check for the following issues:
- Role is not assignable: Ensure user is not already active or assigned via group
- Activation denied: Check for missing MFA or justification field
- Graph API errors: Confirm required permissions and scope during token request
- Local users can bypass restrictions: Verify GPO and registry restrictions are in place to prevent elevation via local admin accounts
NinjaOne RMM provides enhanced visibility and control over your entire IT infrastructure and endpoints
Microsoft Entra ID Privileged Identity Management provides a complete JIT administrative elevation solution that is enforced at the cloud level. The security offered by this functionality can be extended using NinjaOne RMM to get full insights into all of your devices, services, and user activity in one place, and automate configuration deployment across all devices.
NinjaOne’s MSP and UEM platform provides tools for script enforcement, pushing registry or GPO policies, and supports monitoring log files and Windows Events for full auditing capability (including privilege escalations). It also includes reporting and compliance logging, so you can correlate PIM activation with endpoint activity, ensuring that administrative escalation is authorized and used responsibly.
NinjaOne also includes automation tools that can deactivate user accounts if suspicious activity is detected, isolate affected systems, and escalate tickets to the relevant stakeholder or run remediation scripts, greatly enhancing your ability to automate security incident response.
