What is the Use case of Privileged Access Groups?

Question

My understanding is that, using Privileged Access Groups (PAGs), you can add several members to the group, who need elevated access to do privileged tasks.
Not sure if that's correct.

But if that's correct, what could be a classic problem that PAGs solves?

Answer 1

Hi @Ravikiran S · Thank you for reaching out.

The groups with below option enabled are the only groups that can be configured as Privileged Access Groups. Which means, any privilege role like User admin, Global admin, Authentication admin etc. can be assigned to this group.

Classic problem that PAGs solves:

1. You can assign administrative role to the group and all group members will get privileges based on the role assigned to the group. Role assignment is not required to be done on per user basis.
2. Privileged Access Groups enable just-in-time (JIT) access to the Owner or Member role of this group with the help of Azure AD Privilege Identity Management (PIM). This allows eligible users to be activate their membership of PAG for a specific period of time whenever they need and at the expiry of the specified time, membership will be removed automatically. Previously this could be done only at the role level and not at group level.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.