Privileged Identity Management
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 91b5373 · +7 −7 lines · also on GitHub
⋯ 6 unchanged lines
77
ms.service: entra-id-governance
88
ms.subservice: privileged-identity-management
99
ms.topic: overview
10
−ms.date: 10/26/2023
10
+ms.date: 01/06/2024
1111
ms.author: barclayn
1212
ms.reviewer: ilyal
1313
ms.custom: pim, azuread-video-2020, content-engagement
⋯ 52 unchanged lines
6666
6767
| Term or concept | Role assignment category | Description |
6868
| --- | --- | --- |
69
−| eligible | Type | A role assignment that requires a user to perform one or more actions to use the role. If a user has been made eligible for a role, that means they can activate the role when they need to perform privileged tasks. There's no difference in the access given to someone with a permanent versus an eligible role assignment. The only difference is that some people don't need that access all the time. |
69
+| eligible | Type | A role assignment that requires a user to perform one or more actions to use the role. If a user is eligible for a role, they can activate the role when they need to perform privileged tasks. There's no difference in the access given to someone with a permanent versus an eligible role assignment. The only difference is that some people don't need that access all the time. |
7070
| active | Type | A role assignment that doesn't require a user to perform any action to use the role. Users assigned as active have the privileges assigned to the role. |
7171
| activate | | The process of performing one or more actions to use a role that a user is eligible for. Actions might include performing a multifactor authentication (MFA) check, providing a business justification, or requesting approval from designated approvers. |
7272
| assigned | State | A user that has an active role assignment. |
⋯ 2 unchanged lines
7575
| permanent active | Duration | A role assignment where a user can always use the role without performing any actions. |
7676
| time-bound eligible | Duration | A role assignment where a user is eligible to activate the role only within start and end dates. |
7777
| time-bound active | Duration | A role assignment where a user can use the role only within start and end dates. |
78
−| just-in-time (JIT) access | | A model in which users receive temporary permissions to perform privileged tasks, which prevents malicious or unauthorized users from gaining access after the permissions have expired. Access is granted only when users need it. |
78
+| just-in-time (JIT) access | | A model in which users receive temporary permissions to perform privileged tasks, which prevents malicious or unauthorized users from gaining access after the permissions expire. Access is granted only when users need it. |
7979
| principle of least privilege access | | A recommended security practice in which every user is provided with only the minimum privileges needed to accomplish the tasks they're authorized to perform. This practice minimizes the number of Global Administrators and instead uses specific administrator roles for certain scenarios. |
8080
8181
## Role assignment overview
⋯ 15 unchanged lines
9797
- The type of the assignment
9898
- **Eligible** assignments require the member of the role to perform an action to use the role. Actions might include activation, or requesting approval from designated approvers.
9999
- **Active** assignments don't require the member to perform any action to use the role. Members assigned as active have the privileges assigned to the role.
100
−- The duration of the assignment, using start and end dates or permanent. For eligible assignments, the members can activate or requesting approval during the start and end dates. For active assignments, the members can use the assign role during this period of time.
100
+- The duration of the assignment, using start and end dates or permanent. For eligible assignments, the members can activate or requesting approval during the start and end dates. For active assignments, the members can use the assigned role during this period of time.
101101
102102
The following screenshot shows how administrator assigns a role to members.
103103
⋯ 4 unchanged lines
108108
109109
### Activate
110110
111
−If users have been made eligible for a role, then they must activate the role assignment before using the role. To activate the role, users select specific activation duration within the maximum (configured by administrators), and the reason for the activation request.
111
+If users are eligible for a role, then they must activate the role assignment before using the role. To activate the role, users select specific activation duration within the maximum (configured by administrators), and the reason for the activation request.
112112
113113
The following screenshot shows how members activate their role to a limited time.
114114
⋯ 5 unchanged lines
120120
121121
### Approve or deny
122122
123
−Delegated approvers receive email notifications when a role request is pending their approval. Approvers can view, approve or deny these pending requests in PIM. After the request has been approved, the member can start using the role. For example, if a user or a group was assigned with Contribution role to a resource group, they are able to manage that particular resource group.
123
+Delegated approvers receive email notifications when a role request is pending their approval. Approvers can view, approve, or deny these pending requests in PIM. After the request is approved, the member can start using the role. For example, if a user or a group was assigned with Contribution role to a resource group, they are able to manage that particular resource group.
124124
125125
For more information, check out the following articles: [Approve or deny requests for Microsoft Entra roles](./pim-approval-workflow.md), [Approve or deny requests for Azure resource roles](pim-resource-roles-approval-workflow.md), and [Approve activation requests for PIM for Groups](groups-approval-workflow.md)
126126
⋯ 2 unchanged lines
129129
After administrators set up time-bound owner or member assignments, the first question you might ask is what happens if an assignment expires? In this new version, we provide two options for this scenario:
130130
131131
- **Extend** – When a role assignment nears expiration, the user can use Privileged Identity Management to request an extension for the role assignment
132
−- **Renew** – When a role assignment has already expired, the user can use Privileged Identity Management to request a renewal for the role assignment
132
+- **Renew** – When a role assignment expires, the user can use Privileged Identity Management to request a renewal for the role assignment
133133
134134
Both user-initiated actions require an approval from a Global Administrator or Privileged Role Administrator. Admins don't need to be in the business of managing assignment expirations. You can just wait for the extension or renewal requests to arrive for simple approval or denial.
135135
⋯ 35 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 06:04 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.