Best Practices to implement Entra PIM

Question

I am implementing Entra PIM. I want few points on best practices that are highly recommended to follow, for example, Break Glass, Emergency Accounts, etc..

Can anyone help me to prepare a list?

Answer 1

Hi, more info on BreakGlass:

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access

Its important to exclude these from MFA/Conditional Access and monitor logons to them. Have at least 2 Break glass accounts.

Otherwise, PIM and least priv best practices:

https://learn.microsoft.com/en-us/security/zero-trust/develop/identity-iam-development-best-practices

Lots to read, but worth it:

https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/

Answer 2

Refer to https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-planning

---

hth

Marcin

Answer 3

Refer to

https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-deployment-plan

and

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access

We recommend you keep zero permanently active assignments for roles other than the recommended two break-glass emergency access accounts, which should have the permanent Global Administrator role.

---

hth
Marcin