Rules/ID-002.pim-over-permanent.psd1
|
@{ Id = 'ID-002' Title = 'PIM eligibility is used instead of permanent Global Administrator assignments' Area = 'RoleAssignments' Severity = 'Medium' References = @( 'https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-configure' ) Rationale = 'Standing Global Administrator access is a permanent attack surface. Where PIM is in use, admins should be eligible and activate just-in-time; only break-glass accounts stay permanent.' Remediation = 'Convert permanent Global Administrator assignments (beyond the two break-glass accounts) to PIM-eligible assignments.' Test = { param($Snapshot) $roleData = $Snapshot.RoleAssignments $pimInUse = [bool]($roleData.eligibilityAvailable -and @($roleData.eligibility).Count -gt 0) if (-not $pimInUse) { return New-TLRuleResult -Status Manual -Evidence 'No PIM eligibility data found (Entra ID P2 not licensed or PIM unused) - review standing assignments manually.' } $permanentAdmins = @($roleData.assignments | Where-Object { $_._tlRoleName -eq 'Global Administrator' }) $principals = @($permanentAdmins | ForEach-Object { [string]$_.principalId } | Sort-Object -Unique) if ($principals.Count -le 2) { New-TLRuleResult -Status Pass -Evidence ("{0} permanent Global Administrator(s) (break-glass budget), PIM eligibility in use." -f $principals.Count) } else { New-TLRuleResult -Status Fail -Evidence ("{0} permanent Global Administrators although PIM is in use - convert to eligible assignments." -f $principals.Count) } } } |