Just-in-Time Privileged Access

Sample case study — realistic but fictional. Replace with your own engagement and metrics.

Context

A regulated fintech needed to prove that no human held permanent administrative rights to production. The platform ran on Azure, and most privileged roles were assigned permanently to individuals — convenient for engineers, indefensible to auditors.

Problem

• Permanent role assignments meant the blast radius of any one compromised account was the entire control plane.
• No approval trail. Elevation was implicit; there was nothing to review.
• Audit fatigue. Quarterly access certifications were a manual spreadsheet exercise that everyone rubber-stamped.

Approach

• Adopted Entra ID Privileged Identity Management (PIM) to make every privileged role eligible, not active — engineers request elevation when they need it.
• Gated sensitive roles behind approval + justification + MFA, with a hard time-box so access expires automatically.
• Streamed activation events to Microsoft Sentinel for alerting and a permanent audit trail.
• Defined role settings and assignments in Terraform so the access model is reviewed like any other change.

Architecture

Outcome

• Zero standing privileged assignments in production — every elevation is now eligible-by-default and time-boxed.
• Median elevation under 2 minutes with one-click approvals, so security didn’t cost engineers their velocity.
• Continuous audit trail: every activation carries who, why, and for how long, replacing the quarterly spreadsheet with queryable evidence.

Stack

• Entra ID PIM — eligible roles, approval workflows, and automatic expiry.
• Conditional Access — enforces MFA and device trust at activation time.
• Microsoft Sentinel — alerting and the immutable activation audit trail.
• Terraform — privileged role configuration as reviewable code.