Implementing Privileged Identity Management with Azure

Overview

Azure AD Privileged Identity Management (PIM) enforces just-in-time privileged access by converting permanent role assignments to eligible assignments that require activation. This skill uses the Microsoft Graph API to enumerate active and eligible role assignments, create eligibility schedule requests, configure role management policies (MFA requirements, approval workflows, maximum activation duration), audit PIM activation logs, and identify over-privileged permanent assignments that should be converted to eligible.

Prerequisites

• Python 3.9+ with msal, requests
• Azure AD application registration with RoleManagement.ReadWrite.Directory, RoleEligibilitySchedule.ReadWrite.Directory permissions
• Microsoft Entra ID P2 or Microsoft Entra ID Governance license

Key Operations

1. List eligible assignments — GET /roleManagement/directory/roleEligibilityScheduleInstances
2. Create eligibility requests — POST /roleManagement/directory/roleEligibilityScheduleRequests
3. Activate eligible role — POST /roleManagement/directory/roleAssignmentScheduleRequests with action=selfActivate
4. Audit role activations — GET /auditLogs/directoryAudits filtered by PIM activities
5. Review role policies — GET /policies/roleManagementPolicies to check MFA/approval requirements

Output

JSON audit report with permanent vs. eligible assignment counts, over-privileged accounts, policy compliance status, and recent activation history.

Verification Criteria

Confirm successful execution by validating:

• [ ] All prerequisite tools and access requirements are satisfied
• [ ] Each workflow step completed without errors
• [ ] Output matches expected format and contains expected data
• [ ] No security warnings or misconfigurations detected
• [ ] Results are documented and evidence is preserved for audit

Compliance Framework Mapping

This skill supports compliance evidence collection across multiple frameworks:

• SOC 2: CC6.1 (Logical Access), CC6.2 (Credentials), CC6.3 (Provisioning)
• ISO 27001: A.9.1 (Access Control), A.9.2 (User Access Management), A.9.4 (System Access Control)
• NIST 800-53: AC-2 (Account Management), IA-2 (Identification), AC-6 (Least Privilege)
• NIST CSF: PR.AC (Access Control)

Claw GRC Tip: When this skill is executed by a registered agent, compliance evidence is automatically captured and mapped to the relevant controls in your active frameworks.

Deploying This Skill with Claw GRC

Agent Execution

Register this skill with your Claw GRC agent for automated execution:

# Install via CLI
npx claw-grc skills add implementing-privileged-identity-management-with-azure

# Or load dynamically via MCP
grc.load_skill("implementing-privileged-identity-management-with-azure")

Audit Trail Integration

When executed through Claw GRC, every step of this skill generates tamper-evident audit records:

• SHA-256 chain hashing ensures no step can be modified after execution
• Evidence artifacts (configs, scan results, logs) are automatically attached to relevant controls
• Trust score impact — successful execution increases your agent's trust score

Continuous Compliance

Schedule this skill for recurring execution to maintain continuous compliance posture. Claw GRC monitors for drift and alerts when re-execution is needed.