Many organizations use Microsoft Entra Privileged Identity Management (PIM) to manage privileged access to Microsoft Entra ID and Azure. Instead of giving users permanent privileged access, organizations make them eligible to activate permissions when a need arises.
The organization can control the authentication requirements, whether users must provide a justification, whether the request requires approval and how long the permission remains active. This reduces the attack surface and supports the principles of least privilege and just-in-time access.
But what about Active Directory? Privileged access there is still often based on permanent membership in AD groups. As a result, the security model provided by Entra PIM does not always extend to the on-premises environment.
The same challenge often remains on-premises
Although many organizations have moved parts of their IT environment to the cloud, much of their infrastructure still runs on-premises. Windows servers, databases, file servers and business systems continue to use Active Directory to control privileged access.
Permissions are often based on membership in groups such as:
- Domain Admins
- Server administrators
- RDP administrators
- Backup operators
- Helpdesk
- Business system administrators
In many organizations, these memberships are permanent. Users receive elevated permissions and keep them until someone removes them manually. Privileges can therefore remain in place longer than necessary, making the principle of least privilege more difficult to enforce.
Users request access when they need it
With Fortified ID Control, the same approach can be applied to Active Directory. The organization defines which users are eligible to request a specific role or permission. Eligibility does not mean that users already have the permission; it only gives them the right to request it when a need arises.
When a user initiates a request, the organization’s policy determines the process:
- Access can be activated immediately after successful authentication.
- The request can require approval from one or more designated people.
- Designated people can be notified when a privileged role is activated or deactivated.
- Access remains active only for the period defined by the organization.
This ensures that users do not receive elevated permissions until they actually need them.
Each role can have its own policy
Not all privileged roles carry the same level of risk. Each role can therefore have its own policy, with requirements tailored to the sensitivity of the role or resource.
- A server administrator may be allowed to activate access for two hours immediately after completing MFA.
- A Tier 0 administrator may need to use a national eID at a specified assurance level, provide a justification and wait for approval from both the system owner and the security officer.
- An external consultant may receive access to a specific server only during a planned maintenance window.
The same solution can support both self-activation and approval workflows across the organization.
Access expires automatically
Once a request has been approved, the user receives time-limited membership in the AD group that represents the role. For Active Directory, Fortified ID Control can use the built-in Time to Live (TTL) functionality, which automatically expires the membership when the approved period ends.
No one needs to remember to remove the user from the group manually, reducing the risk of privileged access remaining active longer than intended.
An example: an external consultant during a maintenance window
An external consultant needs to upgrade a business system during a planned maintenance window. The consultant is eligible to request the role Server Administrator – ERP Production, but has no permanent administrator permissions.
The process works as follows:
- The consultant signs in to Fortified ID Control.
- The consultant requests the role Server Administrator – ERP Production.
- Fortified ID Control verifies the consultant’s identity according to the organization’s policy, for example by using a national eID.
- Because the role is classified as sensitive, the request is sent to the system owner for approval.
- When the request is approved, the consultant is automatically added to the AD group that provides the required permissions.
- Access remains active for four hours and applies only to the relevant resource.
- When the time expires, the Active Directory group membership ends automatically.
The consultant receives only the access required for the assignment – no more and for no longer than necessary.
Full traceability from request to expiry
For privileged access, traceability is just as important as the permission assignment itself. Every step in the process is documented automatically, creating a complete audit trail. The organization can review the entire sequence of events without relying on manual logs or reconstructing what happened after the fact.
For each activation, the organization can see:
- Who requested access?
- Which role or resource was activated?
- Which authentication method was used?
- Which assurance level was achieved?
- Who approved the request?
- When was access activated?
- When did it expire?
- Which justification or ticket supported the request?
This provides clear evidence for security reviews, audits and compliance with internal policies and external regulations.
The same security principle in the cloud and on-premises
Microsoft Entra PIM enables organizations to manage privileged access to Microsoft Entra ID and Azure. Fortified ID Control makes it possible to apply the same fundamental approach to Active Directory and other connected user directories.
For organizations with hybrid environments, this creates a consistent way to manage privileged access regardless of where the resource resides.