Azure AD PAM implementation

Question

Hello,

I'm training on somes Azure AD and M365 features. I just tried Azure AD PIM and PAM. For the firt, there is no problem with it, the documentation is enough to implement uses cases.

But I have problem with Azure AD PAM for whom I can't find any recent resource except the official documentation by Microsoft (on MS-500 certification learning, for example) : https://learn.microsoft.com/en-us/training/modules/m365-compliance-insider-implement-privileged-access-management/case-study

Moreover, to access to PAM menu, it was not really clear and the features are very limited.

So, my question is : Is Azure PAM still a product maintained by Microsoft ? Has it been deprecated ? I did not found any information about that, but it's very stranger situation.

Thank you for your help.

Answer 1

Thank you for your contribution.

@Nick Riley : It's exactly what I think. Azure AD PAM is very restricted (only Exchange Online available on the "Scope" field). But, it seems we can delegater others Azure AD administratives roles, even you selected Exchange on the Scope, by using "Role Group" on "Policy type" field :

So, it's very confused and the official documentation is not really clear about Azure AD PAM. And the uses cases where we need Azure AD PAM are very restricted if there is only these features.

Answer 2

Azure PAM is actually described here:

https://learn.microsoft.com/en-us/microsoft-identity-manager/pam/privileged-identity-management-for-active-directory-domain-services

and

https://www.microsoft.com/en-us/security/blog/2020/03/02/microsoft-identity-acronyms-what-they-mean-how-they-relate/

Answer 3

I'd just been looking at a similar thing; I know my way around AzureAD PIM. MIM PAM is obviously on-prem AD and as you say, seems to be what people think of when you say PAM - but references to PAM in M365 / AzureAD do seem confusing but do exist!

As-per the link you provided, you can manage some (limited) PAM here (which I suspect you've found already)
https://admin.microsoft.com/Adminportal/Home#/Settings/PrivilegedAccess
Having tried to create a policy, it looks like it's only possible to set the scope to Exchange; I wonder therefore if it'd be better described as Exchange PAM. - I'm not sure what's on the roadmap but it seems to only cover Exchange activities and I've not seen it expand or change at all recently.

• As a note that seems loosely related and maybe more the direction of travel (but equally applies CA policies rather than approval workflows) check out 'protected actions' that is now in preview: https://learn.microsoft.com/en-us/azure/active-directory/roles/protected-actions-overview