The AirGap Blueprints

A Cloud Security Strategy Guide · Coming soon

One Activation, Every Role with PIM Groups

A Practical Guide to Just-in-Time Admin Access with PIM for Groups in Microsoft Entra ID

Kevin Lanflo · Senior Security Architect

Tell me when it's out
Cover of One Activation, Every Role with PIM Groups by Kevin Lanflo

The problem

Admins keep their access because activating it is painful.

When one job needs five separate role activations, each with its own MFA prompt and justification, administrators stop activating and start asking for permanent assignments. Standing privilege spreads quietly, one exception at a time.

The idea

One group. One activation. Every role the job needs.

PIM for Groups bundles the roles for a job into a single group. The admin activates once — time-bound and MFA-protected — and gets everything the task requires, then it expires on its own.

1 activation · MFA · time-bound
  • User AdministratorEntra ID role
  • Intune AdministratorEntra ID role
  • Security ReaderEntra ID role
  • ContributorAzure resource role
  • App accessEnterprise app

Inside the book

What you'll build, step by step

  1. Measure standing accessFind how far permanent privilege has spread before you change anything.
  2. Design job-based groupsGroup roles by the work people actually do, not by the org chart.
  3. Eligible vs. activeWhen each assignment type is right, and how to move people across.
  4. Configure activationMFA, justification, approval and duration — set once per group.
  5. Protect the groupsKeep the groups themselves from becoming the new back door.
  6. Monitor and auditProve it's working, and catch drift before an auditor does.

About the series

The AirGap Blueprints

A series of cloud security strategy guides built on more than 25 years of real-world public and private sector experience. Every book follows the same field-tested structure:

  • Rationale
  • Planning
  • Implementation
  • Adoption

About the author

Kevin Lanflo

Senior Security Architect with 25 years across the private and public sector — planning, implementing and adapting security and compliance programs more than once. The AirGap Blueprints is where that experience goes back to the profession.

Connect with Kevin on LinkedIn

Follow the series

Field lessons, between the books

YouTubeWatch the walkthroughsStep-by-step PIM, Entra ID and Intune builds — and the lessons behind them. @airgapblueprints LinkedInFollow the pageExcerpts, checklists and diagrams from the books, three times a week. The AirGap Blueprints XGet the short takesQuick lessons, launch news and new guides as they land. @AirGapEbooks

Be first to know when it launches

One email when the book is out. No spam, and you can unsubscribe at any time.