Skip to main content
Version: Next

Phase 05: Identity & Access Management

Runbook Azure

DOCUMENT CATEGORY: Runbook SCOPE: Identity and privileged access management PURPOSE: Configure just-in-time access controls and context-aware authentication policies MASTER REFERENCE: Microsoft Learn — Privileged Identity Management

Status: Active


This phase configures Privileged Identity Management (PIM) and Conditional Access policies to protect administrative access to your Azure Local deployment. Both controls reduce standing privileges and enforce contextual auth requirements.

Scope — Security Baselines

Defender for Cloud, Azure Policy, Security Baselines, and Data Collection Rules are configured in Part 6: Operational Foundations (after cluster deployment, when Arc-enabled servers exist).

License Requirements

Entra ID P2 (or Microsoft 365 E5) is required for PIM and risk-based Conditional Access. If unavailable, this phase is optional — document the decision and proceed to on-premises readiness.

Overview

ComponentPurposeAzure Resource
PIM for Azure ResourcesJust-in-time privileged access to subscriptionsPrivileged Identity Management
PIM for Entra ID RolesJust-in-time access to directory admin rolesPrivileged Identity Management
Conditional AccessContext-aware MFA and legacy auth controlsEntra ID Conditional Access
Break-Glass AccountsEmergency access — excluded from all CA policiesEntra ID

Prerequisites

Before starting this phase, ensure:

  • Phase 04 Complete — Azure management infrastructure deployed
  • Entra ID P2 License — Assigned to all administrators
  • Global Administrator or Privileged Role Administrator — To configure PIM
  • Security Administrator — To create Conditional Access policies

Deployment Steps

StepComponentDescriptionEstimated Time
1PIM & Conditional AccessConfigure just-in-time access, break-glass accounts, and CA policies45–60 min

Phase Exit Criteria

After completing Step 1, verify:

  • PIM enabled for Azure subscription roles (Owner, Contributor, UAA)
  • PIM enabled for Entra ID roles (Global Admin, Security Admin, PRA)
  • Eligible assignments configured for the deployment team
  • Two break-glass accounts created, documented, and excluded from all CA policies
  • CA001, CA002, CA003 in Report-Only mode, reviewed, and promoted to On

Next Steps

After completing this phase, proceed to on-premises readiness to prepare Active Directory and network infrastructure.

Next Phase: Part 3 — Phase 01: Active Directory