Azure AD Privileged Identity Management (PIM) - AZ-500, SC-300 Deep Dive Topic

In this video I deep dive into Privileged Identity Management for Azure AD and Azure roles and group management. This topic is required for AZ-500 and SC-300 and also just overall knowledge for just-in-time privileged roles in Azure and Azure AD.
00:00 Introduction
00:27 Azure AD users, groups and services
02:17 Azure AD roles and administrative units
06:06 Azure hierarchy and roles
09:10 Permanent role assignment problems
10:57 Just-in-time elevation and PIM
14:52 Azure AD PIM
18:08 PIM role settings
22:18 Adding Azure AD assignment
25:30 Administrative unit view
26:15 User PIM usage
30:35 Azure PIM
31:30 Discover resources
32:27 Picking the scope for role assignment
33:34 Azure role PIM settings
34:23 Adding Azure role assignment and user demo
41:18 Group-based role assignment
47:30 User group PIM experience
53:30 Renewal and extend role
54:13 Demo redemption :-)
55:25 Summary and close

[@royalcanadianbearforce9841]

Hello John! Thank you so much for providing such wonderful content! I've been watching a lot of your paid content (prepping for AZ 400 exam!) and it has been invaluable! I'm very excited to watch all of your additional KZbin content!

[@sarthaksahoo8259]

Amazing content , thanks john . Don’t know how i missed this one . Really tempted to take the SC-300 after watching this .

[@christianibiri]

Great video! I'm preparing AZ-500 and this is super useful... Again thank you!

[@oranais3074]

As usual excellent presentation. Thanks John.

[@HiYurd]

Another great video, John. This helps me figure out how to setup PIM. Thanks for taking the time to make these very helpful videos.

[@NTFAQGuy]

Glad to help

[@GavinPeters]

Thanks for this video. We're starting PIM implementation right now. I was still able to follow along without too much effort despite the Entra ID rebranding. Bonus news: You've just added a video on PIM and Conditional access, perfect timing for me.

[@SaphireTech]

Really great overview and walkthrough as always, thanks!

[@damianpodgorski6977]

Thanks a lot John! I am preparing for AZ-500 and just have seen that you have started this series!

[@NTFAQGuy]

Best of luck!

[@nospam6956]

John, you are best of the best. Keep doing what you do! Thank you a lot for great and simple explanations!

[@NTFAQGuy]

Thank you! Very kind

[@davidcoronel5249]

Thanks for another great video as always. Congratulations for achieving triumphs in Destiny in 2020 😁

[@paulbendall3878]

Excellent explanation of this powerful feature in Azure and M365. Thanks for taking the time to put together a very comprehensive and clear demonstration of PIM

[@NTFAQGuy]

My pleasure!

[@thtgrldiana6388]

Really great learning session I thank you so much for the knowledge sharing your provide! I really also enjoy the demo-as-you-go presentations they are so helpful putting the content together with the scenarios.. Keep it up John!!!

[@NTFAQGuy]

On it :)

[@kaveshnaidoo2644]

Watching your videos has helped me a lot, passed AZ303 yesterday. Thank you for sharing.

[@NTFAQGuy]

Great job, congrats!

[@outlawtheboyzz4199]

I've watched a few of your videos. You are my new favorite trainer!!!. I've paid for training from people that are over near as thorough as you thank you for your time in putting these videos together!

[@NTFAQGuy]

Welcome aboard!

[@spop1974]

I am prepping for SC-300 and this is pure gold!

[@NTFAQGuy]

Thank you!

[@historianrik]

Somehow everytime I am working on a subject, in the same week you create a video for it :). Thanks!

[@NTFAQGuy]

I'm spying :-)

[@TheNigelboothe]

Yeah I was just looking at this yesterday

[@bshwjt]

Awesome content for Azure Identity management .

[@ER-zj3jv]

Thank you John. Great video as always

[@NTFAQGuy]

Thanks 👍

[@ukaszpolczyk4122]

Sooo good video, I finnaly understood PIM and things around this feature

[@notoriousft]

Thanks again man. This was very helpful for me when preparing for SC-300 (just scraped by 700) today.

[@NTFAQGuy]

Congrats

[@saadxz]

Great content and easy to follow as always! I wanted to learn more about self - elevation in PIM and this was it!

[@NTFAQGuy]

Glad it was helpful!

[@jamesdeano8093]

thank you John can't wait the next part :)

[@notoriousft]

Thanks John. Good timing, I'm preparing for AZ-104.

[@NTFAQGuy]

Good luck

[@paddyland74]

Great coverage.. Thanks John for doing this

[@NTFAQGuy]

My pleasure

[@joneslt]

Fantastic video! Learned a ton. Many thanks!

[@maxseba]

Thank you so much, John! Useful and smooth :) I am going for the SC-300...

[@NTFAQGuy]

Good luck!

[@Max-fi2fl]

@@NTFAQGuy Thanks a lot!

[@patrickboucher892]

merci John. I'm learning, I'm learning... it never stops ;-)

[@NTFAQGuy]

no it doesn't :-)

[@markymarkymarky1974]

Amazing overview and demo, why didn't I find you sooner!!

[@NTFAQGuy]

Glad you found me now :)

[@Mssabbagh]

All of your videos are super useful

[@bertusviljoen4201]

Just cleared AZ-500 thanks for the timely video.

[@NTFAQGuy]

Congrats!

[@bertusviljoen4201]

@@NTFAQGuy Thanks.

[@nattsvart199]

So good! You are the best ❤

[@NTFAQGuy]

Thank you so much!!

[@femya4572]

Love this guy! you are the best, thanks!

[@NTFAQGuy]

Thank you!

[@yulaw3289]

enjoying this video for today learning, thanks a lot!

[@NTFAQGuy]

Happy to hear that!

[@c.4800]

Great video! as always :)

[@gilbertojh5300]

Another great video! Thank you very much! :)

[@NTFAQGuy]

Glad you enjoyed it!

[@johnhart6320]

Enjoyable Learning...Go Figure! :) Thank You John...GREAT STUFF!

[@NTFAQGuy]

Glad you enjoyed it

[@vijaye6204]

Great! very clear explanation, Thank you.

[@NTFAQGuy]

Glad it was helpful!

[@faouzigassemi6222]

Excellent as usual !

[@NTFAQGuy]

Glad you think so!

[@iamdedlok]

Thanks John! Awesome stuff. I absolutely could use some help with AD and understanding more about it. I come from App Dev background and AD is something I am not too familiar with. Your videos are priceless and of immense help. An idea here - the collection of your AD related videos probably could be turned into an Azure AD Masterclass?

[@NTFAQGuy]

Glad you enjoy the content. I do have an AAD playlist but I guess I could better organize it :-)

[@l8erzmonkey]

good sessions my favorite place to learn the microsoft videos and others tend to look at these features with sales pitch rather then a technical overview or real case uses . btw Love the destiny shirt

[@NTFAQGuy]

Hehe thanks

[@TheSmartAnts]

Throughly enjoyed. Might have to look at other stuff you have done.

[@NTFAQGuy]

Please do!

[@mistletoe91]

You explain it the best

[@NTFAQGuy]

Thank you!

[@ivanzara9791]

Thank you, well done

[@danielmorris5470]

love the Destiny shirt

[@monsterpuss]

Cheers john. As ever, very useful and timely. Would be good to see a session on how this ties in with AAD ID protection and risk-based conditional access, particularly where all users are required to use MFA all the time anyway. If I'm (through org policy) always authenticated with MFA, can the elevation to an eligible role be dependent upon having a risk level of below a certain threshold for instance.

[@NTFAQGuy]

Authentication contexts will enable that risk based tie-in.

[@rb-zn7me]

Great stuff. Thanks!

[@NTFAQGuy]

Very welcome

[@bestofgaming4957]

Do you have an AZ-500 walkthrough anytime soon? That would be absolutely amazing since I'm going to take the exam next month. Great content, you read this on all the comments on your videos but your style of presenting makes it extremely well to follow. Keep it up!

[@NTFAQGuy]

I'm doing videos on aspects like I did asc and sentinel last week. One big overview won't work as too much content.

[@bestofgaming4957]

Fair point indeed, that helps us out a lot :).

[@pokmnhyu]

Hi John, I learned a lot from the awesome content you put on KZbin. Just curious whether you build up any dedicated az500 course as I have just started looking into it

[@NTFAQGuy]

I have as-500 playlist that I’m going to start adding topics around.

[@ChanceMinus]

Thank you. I appreciate you...

[@NTFAQGuy]

Thanks!

[@abdelalielghazrani5956]

Thanks John

[@anandchandrashekhar2933]

Thaank you for this

[@NTFAQGuy]

Welcome

[@krimblikrambli]

Amazing!!!!

[@NTFAQGuy]

Thanks!!

[@ziggykowalski9322]

Great stuff. What are your thoughts on using a day to day account with PIM versus using a dedicated secondary admin account with PIM?

[@NTFAQGuy]

Best practices would still say separate for very high privilege accounts like global admins.

[@matikaru9084]

Great video. Can you elaborate a bit on the PIM PowerShell support. As far as I can tell, to elevate with PowerShell, I need to use preview versions of AzureAD module or the Microsoft Graph module. Is this true?

[@NTFAQGuy]

Right, documentation has the necessary pre-reqs and may change to use that.

[@yaseenabrahams4979]

Hi John, will you be creating a AZ-500 playlist soon?

[@NTFAQGuy]

I don’t discuss future content

[@deyanvp]

Could you make a video about the high availability design/setup of AAD? ;) Lost a bit attention to features after yesterdays 4h long AAD global downtime :(

[@NTFAQGuy]

I can't publish content on internals. Microsoft publish RCAs where they talk about some of the features and mitigations.

[@oliviafridman4507]

Thank you for this great content ! I've been a fan of you since PowerShell master class :) I am preparing for sc-300, any good training for that ? Udemy / Pluralsight etc ?

[@NTFAQGuy]

I'm going to start doing more SC-300 here. Not sure of other resources apart from the free ms learn.

[@neilruston8796]

Great video. I think you mean 'gamut' instead of 'gambit', around the 7.15 mark - I pretend I didn't hear some of the US pronunciations.... :)

[@NTFAQGuy]

🤷‍♂️

[@yuliyacher67]

Thanks!

[@saq1bahmed]

is there something that can get me on how to architect dor design the Azure Roles.,,, we have 20 Subs and a lot of RGs ........ that we need to PIM. what I am after is to how to attack roles thier scope and duration best practices.

[@NTFAQGuy]

The docs have some best practices

[@sconnell194]

👍

[@sourabhpanse]

Why microsoft has made this so complicated 😕. Learn from aws how to keep it simple