#Modern Workplace

For a long time Role-based access control (RBAC) has been the method of choice for managing access to organization's resources by using built-in Intune roles. However, there was no way to enforce just-in-time like access control against these roles. This changed earlier in the year 2023, when Microsoft released Privileged Identity Management (PIM) for Groups which allowed creating a just-in-time (JIT) policy to support a wide range of roles such as Microsoft Entra roles, Azure resource roles, Microsoft Intune and non-Microsoft application roles and services.  As of writing this blog, this feature together with PIM integration with Conditional Access went into GA which has now enabled organizations to enforce specific requirements for PIM role activations, thus enhancing the overall security posture. In this blog post, I explore these methods on how to give users just-in-time privileged access to Intune RBAC by using PIM for Groups and leveraging CA by enforcing additional secu...

Back in May 2021, I had published a blog post on setting local admin account using different options available in Intune . While the methods covered in the post still hold up, there is another option available natively in Azure that can be used to setup additional local administrators on Azure AD joined devices. The option involves using Additional local administrators on all Azure AD joined devices  feature in Azure which I didn't cover at the time because of its limitations. Primary limitation being that the user accounts added as additional local admin, also get added to all AAD joined devices. However, while exploring alternatives to a LAPS like solution for a customer recently, I stumbled upon Azure AD role  Azure AD Joined Device Local Administrator. The possibility of using it together with Privileged Identity Management (PIM) within  Additional local administrators on all Azure AD joined devices  feature intrigued me and I just had to try it out. Why Azu...