Home / Azure

AzureChecklistIntermediate

Azure identity foundation: Entra ID roles, PIM and break-glass accounts

Set up least-privilege RBAC with groups, Privileged Identity Management for admin roles, emergency access accounts and managed identities before workloads go live.

Deepak Bhardwaj2 min read

Applies toMicrosoft Entra ID (P2 for PIM), Azure RBAC

1. Emergency (break-glass) accounts

  • Two cloud-only accounts on the *.onmicrosoft.com domain, permanently assigned Global Administrator.
  • Long random passwords split and stored offline, or phishing-resistant FIDO2 keys kept in a safe.
  • Excluded from at least one Conditional Access policy path so a misconfiguration can't lock everyone out.
  • An alert on any sign-in by these accounts (Log Analytics query on SigninLogs + alert rule).
  • Sign-in tested every quarter, and the test recorded.
SigninLogs
| where UserPrincipalName in ("bg-admin1@contoso.onmicrosoft.com", "bg-admin2@contoso.onmicrosoft.com")

2. Groups, not users, in role assignments

az role assignment create --assignee-object-id <group-object-id> --assignee-principal-type Group \
  --role "Contributor" --scope /subscriptions/<sub>/resourceGroups/rg-app1-prod
Persona Typical role Scope
Platform team Owner (eligible via PIM) Management group
App team Contributor Their resource groups
Ops / L2 support Reader + Virtual Machine Contributor Workload subscriptions
Security Security Reader Root management group

Avoid Owner for app teams. Owner can assign roles, which bypasses your design.

3. Privileged Identity Management

  • Global Administrator, Privileged Role Administrator, Owner and User Access Administrator are eligible, not active.
  • Activation needs MFA, a justification and a maximum duration (for example 4 hours).
  • Approval for the most sensitive roles.
  • Monthly access reviews on privileged groups.

4. Workload identities

  • Applications use managed identities, not client secrets.
  • CI/CD uses workload identity federation (GitHub/Azure DevOps OIDC), not stored secrets.
  • Remaining app registrations with secrets have an owner and an expiry alert.
az ad app credential list --id <app-id> --query "[].{end:endDateTime, hint:hint}" -o table

5. Conditional Access baseline

  • MFA for all users; phishing-resistant MFA for admins.
  • Block legacy authentication.
  • Require compliant or hybrid-joined devices for admin portals.
  • Report-only mode first; check impact in sign-in logs before enabling.

HA and DR for identity

Entra ID itself is a global, Microsoft-managed service. Your DR risk is configuration: back up Conditional Access policies and role assignments as code, and if you run AD DS domain controllers in Azure, place at least two per region in different availability zones.

Related fixes