It is often the requirement of large organisations to grant security and compliance roles to non IT staff members of different sections. In this article we take a look at the challenges and its solution while granting the minimum security & compliance permissions for limited time access with proper control and auditing.

Grant the minimum permissions

Microsoft has provided many built-in ‘Role Groups’ such as Compliance Administrator, eDiscovery Manager, Security Administrator, etc., which can be used for the various job roles. These ‘Role Groups’ and associated role permissions can be verified in the permissions tab in Microsoft Purview compliance portal. However they may not be adequate for various use cases.

For example, ‘Content Explorer‘ is one of the most debated features in the compliance portal which allows to list, view and verify actual contents in Microsoft 365 classified against Sensitive info types, Trainable Classifiers, Sensitivity labels and Retention labels. Often the organizations would have ‘Data Protection Officers’ who are authorised to use Content Explorer to analyse the contents. Its common for admins to grant the ‘Compliance Administrator’, ‘Content Explorer List Viewer’ and ‘Content Explorer Content Viewer’ ‘Role Groups’ to the DPO which allow them to use the Content Explorer. Eventually the DPO has more permissions in the compliance portal than required.

Most organisations have Azure privileged identity management configured for Just In Time role access. Any Azure AD roles can be configured for JIT assignments. Multiple Azure AD roles can be allowed at the same time for JIT access through the Privileged access groups feature (Preview as of this writing). However the ‘Role Groups’ in Security & Compliance portals are not available for assignment in the Azure privileged identity management.

Solution

Following are the step by step configuration to address the challenges

1. Create a security group with the ‘Azure AD Role Assign’ setting in Azure AD.

2. Enable the privileged access for the group.

3. Create a custom ‘Role Group’ with the minimum role permissions through Security & Compliance PowerShell. (Built-in ‘Role Groups’ are group of predefined role permissions).

4. Add the Azure AD security group as Member of the custom ‘Role Group’ through Security & Compliance PowerShell.

5. Add the required users to the eligible assignments in the group in Azure AD privileged identity management.

The Azure AD role assignability is an immutable setting. Ensure proper testing is done in test environment before configuring it in production.

2. Enable the privileged access for the group from the group properties tab created in previous step.

3. Create a custom ‘Role Group’ with the minimum permissions through Security & Compliance PowerShell

4. Add the Azure AD security group as Member of the custom ‘Role Group’ through Security & Compliance PowerShell

5. Add the required users to the eligible assignments in the group in Azure AD privileged identity management

Navigate to Privileged Identity Management in Azure portal.

Click on the Privilege access groups (preview) and select the Azure AD group created in previous step.

Click on the ‘Assignments’ options of the security group.

Click on ‘Add assignments’ and add the required users to the ‘Eligible’ assignment.

6. The users can now login to Azure Privileged Identity Management and activate the group membership