#Modern Workplace

For a long time Role-based access control (RBAC) has been the method of choice for managing access to organization's resources by using built-in Intune roles. However, there was no way to enforce just-in-time like access control against these roles. This changed earlier in the year 2023, when Microsoft released Privileged Identity Management (PIM) for Groups which allowed creating a just-in-time (JIT) policy to support a wide range of roles such as Microsoft Entra roles, Azure resource roles, Microsoft Intune and non-Microsoft application roles and services.  As of writing this blog, this feature together with PIM integration with Conditional Access went into GA which has now enabled organizations to enforce specific requirements for PIM role activations, thus enhancing the overall security posture. In this blog post, I explore these methods on how to give users just-in-time privileged access to Intune RBAC by using PIM for Groups and leveraging CA by enforcing additional secu...

  While working on an conditional access requirement involving authentication context, I stumbled upon protected actions in Entra ID and thought of blogging my thoughts and experience working with the feature. What are Protected actions? Protected actions are role permissions with Conditional Access applied for added security. Conditional Access requirements are enforced when a user performs the protected action, triggering a process that will require first satisfying the Conditional Access policies assigned to the required permissions. Because the policy enforcement occurs at the time the user attempts to perform the protected action and not during user sign-in or rule activation, users are prompted only when needed. Protected actions is currently in preview and can be applied to only a limited set of permissions spanning across the following areas: - Conditional Access policy management - Cross-tenant access settings management - Custom rules that define network locations - Prote...