MS Entra ID Privileged Identity Management (PIM)

Permissions required for registering and configuring an app in Microsoft Entra ID.

The account must have permission to manage applications in Microsoft Entra ID. Ideally the account should be in the Global Admin role to grant admin consent.

To enforce just-in-time, least-privilege access to highly sensitive identity administration functions with Keycloak, Privileged Identity Management (PIM) is required. Keycloak is a tier-0 system; standing administrative access significantly increases blast radius and insider-risk. PIM ensures access is time-bound, auditable, and aligned with governance and compliance requirements without changing the authentication flow.

Configure MS Entra ID as an IdP in Keylcoak

1. To continue, it is expected that either the OIDC or SAML SSO has been completed:

• MS Entra ID (OIDC)

• MS Entra ID (SAML v2.0)

1. Ensure Assignment required is enabled on the MS Entra application created above.

2. Prepare the admin group by selecting the tenant-admin group created previously in the OIDC or SAML article and remove all users from this group.

3. Assign the group to the application.

   1. If you had used application roles, use the relevant guide to assign the tenant-admin group to the tenant-admin application role.

      1. Configure app roles to Spark user groups.

      2. Configure Entra ID app roles to Spark user groups.

   2. If you had used groups directly, use the guide to assign the tenant-admin group directly to the application.

      1. Configure Entra ID groups to Spark user groups.

Configure PIM in MS Entra ID

1. Open Privileged Identity Management | Quick start.

2. Expand Manage → Groups.

3. Click Discover groups.

4. Search for the relevant internal group name.

5. Select the group and click Manage Groups.

6. Click OK to onboard the selected groups.

7. Navigate to Privileged Identity Management | Groups.

8. Select the onboarded group.

9. Expand Manage → Assignments.

10. Click Add assignment.

11. Select role Member.

12. Click Select member(s), add users, then click Next.

13. Set the assignment start and end dates.

14. Click Assign.

Test the PIM

Test without PIM

User must have permission to sign in to the MS Entra application.

1. Log in to Spark.

2. Verify you do not have tenant-admin permissions and your membership is user:pf only.

3. Sign out.

Test with PIM

User must have eligibility configured as part of Configure PIM in MS Entra ID.

1. Open Privileged Identity Management | Quick start.

2. In Activate just-in-time, click Activate.

3. Select Groups in the left pane.

4. Under Eligible assignments, activate your group

5. Select duration and provide a reason if required, then click Activate.

6. Log in to Spark.

7. Verify you have tenant-admin permissions and memberships user:pf and tenant-admin .

Demo video

This short video demonstrates the use of PIM for privileged access into a Spark tenant.

2MB

Coherent Spark Microsoft Entra ID PIM.mp4

Open