> For the complete documentation index, see [llms.txt](https://docs.coherent.global/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.coherent.global/identity-and-access-management/single-sign-on/microsoft-entra-id-privileged-identity-management-pim.md).

# Microsoft Entra ID privileged identity management (PIM)

To enforce just-in-time, least-privilege access to highly sensitive identity administration functions with Keycloak, privileged identity management (PIM) is strongly recommended.

Keycloak is a tier-0 system; standing administrative access significantly increases blast radius and insider risk. PIM ensures access is time-bound, auditable, and aligned with governance and compliance requirements without changing the authentication flow.

## Prerequisites

<details>

<summary>Permissions required for registering and configuring an app in Microsoft Entra ID.</summary>

The account must have permission to manage applications in Microsoft Entra ID. Ideally, the account should be in the Global Admin role to grant admin consent.

</details>

## Configure MS Entra ID as an IdP in Keycloak

1. To continue, it is expected that either the OIDC or SAML SSO has been completed:

* [Microsoft Entra ID (OIDC)](/identity-and-access-management/single-sign-on/microsoft-entra-id-oidc.md)
* [Microsoft Entra ID (SAML v2.0)](/identity-and-access-management/single-sign-on/microsoft-entra-id-saml-v2.0.md)

2. Ensure **Assignment required** is enabled on the MS Entra application created above.
3. Select the `tenant-admin` group created previously.
4. Remove all users from this group.
5. Assign the group to the application.
   1. If you had used application roles, use the relevant guide to assign the `tenant-admin` group to the `tenant-admin` application role.
      1. [Microsoft Entra ID (OIDC)](/identity-and-access-management/single-sign-on/microsoft-entra-id-oidc.md#configure-app-roles-to-spark-user-groups).
      2. [Microsoft Entra ID (SAML v2.0)](/identity-and-access-management/single-sign-on/microsoft-entra-id-saml-v2.0.md#configure-entra-id-app-roles-to-spark-user-groups).
   2. If you had used groups directly, use the guide to assign the `tenant-admin` group directly to the application.
      1. [Microsoft Entra ID (OIDC)](/identity-and-access-management/single-sign-on/microsoft-entra-id-oidc.md#configure-app-roles-to-spark-user-groups)
      2. [Microsoft Entra ID (SAML v2.0)](/identity-and-access-management/single-sign-on/microsoft-entra-id-saml-v2.0.md#configure-entra-id-app-roles-to-spark-user-groups)

## Configure PIM in MS Entra ID

1. Open [Privileged Identity Management | Quick start](https://portal.azure.com/#view/Microsoft_Azure_PIMCommon/CommonMenuBlade/~/quickStart).
2. Expand **Manage** → **Groups**.
3. Select **Discover groups**.
4. Search for the relevant internal group name.
5. Select the group and select **Manage Groups**.
6. Select **OK** to onboard the selected groups.
7. Navigate to [Privileged Identity Management | Groups](https://portal.azure.com/#view/Microsoft_Azure_PIMCommon/CommonMenuBlade/~/aadgroup).
8. Select the onboarded group.
9. Expand **Manage** → **Assignments**.
10. Select **Add assignment**.
11. Select role **Member**.
12. Select **Select member(s)**, add users, then select **Next**.
13. Set the assignment start and end dates.
14. Select **Assign**.

## Test the PIM

### Test without PIM

{% hint style="info" %}
User must have permission to sign in to the MS Entra application.
{% endhint %}

1. Sign in to Spark.
2. Verify you **do not** have `tenant-admin` permissions and your membership is `user:pf` only.
3. Sign out.

### Test with PIM

{% hint style="info" %}
User must have eligibility configured as part of [#configure-pim-in-ms-entra-id](#configure-pim-in-ms-entra-id "mention").
{% endhint %}

1. Open [Privileged Identity Management | Quick start](https://portal.azure.com/#view/Microsoft_Azure_PIMCommon/CommonMenuBlade/~/quickStart).
2. In **Activate just-in-time**, select **Activate**.
3. Select ***Groups*** in the left pane.
4. Under **Eligible assignments**, activate your group
5. Select duration and provide a reason if required, then select **Activate**.
6. Sign in to Spark.
7. Verify you have `tenant-admin` permissions and memberships `user:pf` and `tenant-admin`.

## Demo video

This short video demonstrates the use of PIM for privileged access into a Spark tenant.

{% file src="/files/JgWwnvz040y9b7zhiA5u" %}