Using Azure Multi-Factor Authentication

Leveraging the Privileged Identity Management service

This service (currently in public preview as of this writing) is available in the new Azure portal at https://portal.azure.com/. The portal allows you to add the Privileged Identity Management tile to your Startboard.

Today, most IT professionals enjoy permanent and unmonitored permissions to high-value resources. While this could be convenient, it poses major security concerns and makes their accounts high-value targets for security attacks. In many of the recent high-profile security breaches that made the headlines in the newspapers, an attacker simply found a way to compromise a user account that was permanently assigned to privileged roles.

The attacker was then able to use that account to access resources across the organization's network, in many cases going undetected for months. These network attacks are referred as to Advanced Persistent Threats (APT): “a set of stealthy and continuous computer hacking processes, often orchestrated by human(s) targeting a specific entity. APT usually targets organizations and/or nations for business or political motives. APT processes require a high degree of covertness over a long period of time.”²³⁸

The Azure AD PIM service reduces this risk around access to these privileged roles by enabling you to:

• 
  Discover and monitor privileged roles. The Azure AD PIM Dashboard gives you visibility into and tracking of users with privileged roles.
  
• 
  Automatically restrict the time that users have these privileged permissions through on-demand "just in time (JIT)" activation of permissions for pre-configured time windows.
  
• 
  Monitor and track privileged operations for audit purposes or security incident forensics.
  

In upcoming releases, a bunch of new capabilities is going to be added, such as:

• 
  Add stronger workflow gates for activation: Multi-Factor Authentication, human approval, and integration with ticketing systems
  
• 
  Expanded management coverage for additional privileged roles and resources such as Office 365, Azure, and SaaS applications managed by Azure AD
  
• 
  Expose APIs so you can to integrate your own workflow experiences.
  

1. 
   Open a browsing session and navigate to the new Azure Portal at https://portal.azure.com/.
   
2. 
   Click Sign in and enter the credentials for a global administrator account of your organization that has a trial or paid subscription to Azure AD Premium.
   
3. 
   Select Marketplace, and then select Security + Identity, or search for it by typing “Identity”.
   

4. 
   Click Azure AD Privileged Identity. An introductory blade opens up.
   

5. 
   Click Create. This will open another blade.
   

6. 
   Once verification is completed, click Create once again.
   

7. 
   Once provisioned, you will receive in parallel a signup notification mail.
   

8. 
   At this stage, you are ready to begin managing privileged identities. Click Activate my role to activate your membership.
   

A list of roles assigned to you: the global administrator role with "permanent activation" and the new security administrator for which you need to "request activation". The security administrator manages the other privileged identities.

9. 
   Click Security Administrator, and the Make active… Finish the wizard to request activation for the security administrator role.
   

10. 
    Click Manage identities in the Privileged Identity Management blade. A new blade opens up.
    

For each privileged role, you can see how many users are assigned to that role, how many of these assignments are currently active and how many are permanently active. The blade also shows a summary of the security alerts. For instance, if there are too many permanent assignments, it shows an alert as illustrated above for the global administrators.

Azure AD PIM provides a self-service experience for administrators.

The privileged identities managed by the service are regular users until they’re activated into their assigned privileged role. Users must activate the privileged role to which they’ve been assigned. After activation, they can complete privileged operations until their access to the privileged role expires.

In today's preview, when a user submits an activation request, the request is logged in the system. The request is immediately auto-approved, and the role is activated for the time period that is pre-configured for the role (this time period for the role can be configured by the security administrator).

Capabilities will be added so that you can secure the activation for a role even further by using security gates such as Azure Multi-Factor Authentication (MFA), human approval, or validation of an incident ticket assigned to the requesting user.