What's changed: Created SC-100 Chapter 3 (Domain 2 second-half: Entra ID/hybrid identity (Entra Connect, PHS/PTA/federation)/external identity (B2B/decentralized); Conditional Access/Entra ID Protection risk/CAE/protected actions/AD DS hardening/Key Vault/managed identity; enterprise access model/PIM/entitlement management/access reviews/CIEM (Entra Permissions Management)/PAW; regulatory compliance (requirements→controls)/Microsoft Purview/Microsoft Priva/Azure Policy/Defender for Cloud regulatory dashboard).
3.3Securing privileged access and CIEM
Understand assigning/delegating privileged roles via the enterprise access model, Entra Privileged Identity Management (PIM)/entitlement management/access reviews, cloud infrastructure entitlement management (CIEM), secure workstations for privileged access (PAW), and securing cloud-tenant administration.
Attackers’ ultimate goal is often "privilege." Even in ransomware, the key to lateral movement was stolen admin rights. Securing privileged access is Zero Trust’s least privilege and RaMP’s top priority.
3.3.1Enterprise access model and PIM
The enterprise access model separates control/management/data planes and isolates privilege in "layers" (successor to the old tier model). Its core implementation is Microsoft Entra Privileged Identity Management (PIM), which does not grant admin roles standing—it elevates Just-In-Time only when needed, with approval, time limits, MFA, and reason logging, then auto-expires. Architects replace "five standing Global Administrators" with PIM eligibility + fewer admins + designed break-glass accounts.
3.3.2Access governance and CIEM
Govern the access lifecycle with entitlement management (access packages centralizing request/approval/expiry) and access reviews (periodically re-checking "still needed?" and revoking). In multicloud, permissions tend to balloon; CIEM (Cloud Infrastructure Entitlement Management) = Microsoft Entra Permissions Management visualizes and reduces over-permissions across Azure/AWS/GCP (cutting unused permissions = continuous least privilege). Architects make CIEM central to "how to continuously curb multicloud over-permissions."
3.3.3Secure workstations (PAW) and tenant protection
If privileged operations come from a compromised endpoint, even PIM and MFA can be bypassed. Privileged Access Workstations (PAW) allow management operations only from dedicated hardened devices with email/browsing removed (isolate remote privileged access similarly). Also design protection of SaaS/multicloud tenant administration itself (admin separation, Conditional Access, auditing). Architects minimize and isolate the "admin entry point."
Cues: "no standing admin rights; elevate only when needed with approval, auto-expiry" = PIM (JIT). "centralize access request/approval/expiry" = entitlement management. "periodically review and revoke" = access reviews. "visualize/reduce over-permissions across Azure/AWS/GCP" = Entra Permissions Management (CIEM). "manage only from a dedicated hardened device" = PAW.
Watch the mix-ups: (1) Distinguish PIM (JIT elevation of Entra/Azure roles) from CIEM/Permissions Management (reducing multicloud over-permissions). (2) Even with PIM, design separate break-glass accounts. (3) MFA/PIM alone are insufficient—address admin-endpoint (PAW) compromise too.
3.3.4Section summary
- Isolate privilege in layers (enterprise access model); PIM elevates JIT with approval/expiry/auto-revoke, no standing grants
- Govern lifecycle with entitlement management + access reviews; CIEM (Permissions Management) reduces multicloud over-permissions
- Limit admin operations to PAW hardened devices, isolate the tenant-admin entry; design break-glass separately
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To avoid standing admin roles—elevating only when needed with approval and time limits, then auto-expiring—which is best?
Q2. To visualize and continuously reduce over-permissions (unused) across Azure, AWS, and GCP, which is best?
Q3. To prevent permission creep over time and periodically review/revoke access, which is best?
Q4. To allow admin operations only from dedicated hardened devices without email/browsing, which is best?
Q5. Which design principle separates control/management/data planes to isolate privilege in layers?