Microsoft Entra ID privileged identity management (PIM)

To enforce just-in-time, least-privilege access to highly sensitive identity administration functions with Keycloak, privileged identity management (PIM) is strongly recommended.

Keycloak is a tier-0 system; standing administrative access significantly increases blast radius and insider risk. PIM ensures access is time-bound, auditable, and aligned with governance and compliance requirements without changing the authentication flow.

Prerequisites

Permissions required for registering and configuring an app in Microsoft Entra ID.

The account must have permission to manage applications in Microsoft Entra ID. Ideally, the account should be in the Global Admin role to grant admin consent.

Configure MS Entra ID as an IdP in Keycloak

1. To continue, it is expected that either the OIDC or SAML SSO has been completed:

• Microsoft Entra ID (OIDC)

• Microsoft Entra ID (SAML v2.0)

1. Ensure Assignment required is enabled on the MS Entra application created above.

2. Select the tenant-admin group created previously.

3. Remove all users from this group.

4. Assign the group to the application.

   1. If you had used application roles, use the relevant guide to assign the tenant-admin group to the tenant-admin application role.

      1. Configure app roles to Spark user groups.

      2. Configure Entra ID app roles to Spark user groups.

   2. If you had used groups directly, use the guide to assign the tenant-admin group directly to the application.

      1. Configure app roles to Spark user groups

      2. Configure Entra ID app roles to Spark user groups

Configure PIM in MS Entra ID

1. Open Privileged Identity Management | Quick start.

2. Expand Manage → Groups.

3. Select Discover groups.

4. Search for the relevant internal group name.

5. Select the group and select Manage Groups.

6. Select OK to onboard the selected groups.

7. Navigate to Privileged Identity Management | Groups.

8. Select the onboarded group.

9. Expand Manage → Assignments.

10. Select Add assignment.

11. Select role Member.

12. Select Select member(s), add users, then select Next.

13. Set the assignment start and end dates.

14. Select Assign.

Test the PIM

Test without PIM

User must have permission to sign in to the MS Entra application.

1. Sign in to Spark.

2. Verify you do not have tenant-admin permissions and your membership is user:pf only.

3. Sign out.

Test with PIM

User must have eligibility configured as part of Configure PIM in MS Entra ID.

1. Open Privileged Identity Management | Quick start.

2. In Activate just-in-time, select Activate.

3. Select Groups in the left pane.

4. Under Eligible assignments, activate your group

5. Select duration and provide a reason if required, then select Activate.

6. Sign in to Spark.

7. Verify you have tenant-admin permissions and memberships user:pf and tenant-admin.

Demo video

This short video demonstrates the use of PIM for privileged access into a Spark tenant.

pim-jit.mp4

2MB

Open