Elevated Access for Azure AD Users

Question

Elevated Access for Azure AD Users

Anonymous

Hey guys,

I'm managing 100 Azure AD users who utilize corporate-owned laptops for signing in and performing tasks. All these users are configured as standard users. Therefore, when the IT team runs an application with elevated access or doing administrative tasks, a prompt appears requesting a username and password

I am looking for a solution to create specific Azure users and provide them to the helpdesk team. This way, they can use these Azure users to run or install applications with elevated privileges.

We are using Azure AD, not Azure AD Domain Services

Thanks for your help in advance.

Umar 150 Reputation points

2024-04-30T05:39:57.48+00:00
To enable elevated access for specific tasks without compromising security, you can leverage Azure AD roles and Azure AD Privileged Identity Management (PIM). Here's how you can achieve this:

Create Azure AD roles: Define custom Azure AD roles tailored to your organization's requirements. These roles should grant the necessary permissions for elevated access, such as installing applications or performing administrative tasks.

Assign Azure AD roles: Assign these custom roles to the designated helpdesk team members. This can be done through Azure AD's role assignment feature, ensuring that only authorized personnel have elevated privileges.

Configure Privileged Identity Management (PIM): Utilize Azure AD PIM to manage, control, and monitor access within your organization. With PIM, you can enforce just-in-time access, requiring users to activate their privileged role when needed and for a specified duration. This adds an additional layer of security by limiting the exposure of elevated privileges.

Implement conditional access policies: Set up conditional access policies to ensure that elevated access is granted only under specific conditions, such as from trusted locations or devices. This helps mitigate the risk of unauthorized access attempts.

By combining Azure AD roles, PIM, and conditional access policies, you can effectively manage and secure elevated access for your helpdesk team while minimizing the risk of unauthorized access or misuse of privileges.
Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator

2024-04-30T09:02:44.5166667+00:00

@Mo Thank you for reaching out to us, just check if this 3rd party blog - https://skotheimsvik.no/five-approaches-for-local-admin-access-on-the-azure-ad-joined-pc#:~:text=The%20Device%20Administrator%20role%20can,all%20Azure%20AD%20joined%20devices. helps to achieve your ask.

Reference: https://learn.microsoft.com/en-us/answers/questions/1300903/azure-ad-joined-device-local-administrator-role-to

Let me know if you have any further questions, feel free to post back.

Your answer

Umar 150 Reputation points

2024-04-30T05:39:57.48+00:00

To enable elevated access for specific tasks without compromising security, you can leverage Azure AD roles and Azure AD Privileged Identity Management (PIM). Here's how you can achieve this:

Create Azure AD roles: Define custom Azure AD roles tailored to your organization's requirements. These roles should grant the necessary permissions for elevated access, such as installing applications or performing administrative tasks.

Assign Azure AD roles: Assign these custom roles to the designated helpdesk team members. This can be done through Azure AD's role assignment feature, ensuring that only authorized personnel have elevated privileges.

Configure Privileged Identity Management (PIM): Utilize Azure AD PIM to manage, control, and monitor access within your organization. With PIM, you can enforce just-in-time access, requiring users to activate their privileged role when needed and for a specified duration. This adds an additional layer of security by limiting the exposure of elevated privileges.

Implement conditional access policies: Set up conditional access policies to ensure that elevated access is granted only under specific conditions, such as from trusted locations or devices. This helps mitigate the risk of unauthorized access attempts.

By combining Azure AD roles, PIM, and conditional access policies, you can effectively manage and secure elevated access for your helpdesk team while minimizing the risk of unauthorized access or misuse of privileges.
Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator

2024-04-30T09:02:44.5166667+00:00

@Mo Thank you for reaching out to us, just check if this 3rd party blog - https://skotheimsvik.no/five-approaches-for-local-admin-access-on-the-azure-ad-joined-pc#:~:text=The%20Device%20Administrator%20role%20can,all%20Azure%20AD%20joined%20devices. helps to achieve your ask.

Reference: https://learn.microsoft.com/en-us/answers/questions/1300903/azure-ad-joined-device-local-administrator-role-to

Let me know if you have any further questions, feel free to post back.

Share via

Elevated Access for Azure AD Users

Your answer