Enabling optional PAM feature

Bojan Zivkovic 441

Hi, I have forest which in the future will become managed forest when ESAE or its successor approach is implemented. Can I now enable PAM feature which can help me a lot by allowing time limited group membership without affecting future architecture where JIT will be implemented by MIM/PAM? Asking this because having been enabled, PAM feature can not be disabled.

2 answers

Fan Fan 15,336 Reputation points Microsoft Vendor

2021-02-12T02:38:18.343+00:00

Hi,

Since you it is more related to the MIM deployment , I can't give you more professional advice .
I would suggest you open a new thread with the tag Microsoft-Identity-Management.

Following link for your reference:
https://learn.microsoft.com/en-us/microsoft-identity-manager/pam/privileged-identity-management-for-active-directory-domain-services

Best Regards,
Please sign in to rate this answer.
Bojan Zivkovic 441 Reputation points

2021-02-12T08:18:40.817+00:00

I changed a tag.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Tom Houston 176 Reputation points

2021-02-12T20:17:07.04+00:00

Hey @Bojan Zivkovic ,

Yes you can enable the PAM feature in your Bastion forest without impacting a future MIM/PAM deployment. You may want to consider Microsoft's updated privileged user access strategy before making a substantial investment in the ESAE.

Hope this helps
Please sign in to rate this answer.
Bojan Zivkovic 441 Reputation points

2021-02-13T18:51:37.81+00:00

Hey Tom, as I said forest I want to enable AD PAM feature in, will be managed forest in ESAE - not Bastion (Red) forest.

Tom Houston 176 Reputation points

2021-02-13T20:29:07.287+00:00

Hey @Bojan Zivkovic ,

I can't think of a reason you couldn't use PAM in the Corp forest, but maybe check the support position first with your Microsoft representative. I have personally only ever deployed PAM in the Bastion forest environment, but Microsoft has recently withdrawn this forest architecture from their mainstream recommendations.

Hope this helps

Bojan Zivkovic 441 Reputation points

2021-02-14T13:05:11.187+00:00

Thanks, I know PAM is always deployed in the Bastion forest but as component of MIM, not as optional AD feature.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Enabling optional PAM feature

2 answers

Your answer