Implementation examples
4 examples referencing Microsoft Entra PIM
- AU.L2-3.3.9[a] [b]
Two named log administrators; analysts and engineers get read-only search
AO coverage. Addresses both Audit Management objectives: the subset of privileged users allowed to manage audit logging functionality is defined, and management is limited to that subset. Defined…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.15[a] [b] [c] [d]
Privileged remote admin only via PAW with ticketed authorization
AO coverage. Addresses all Privileged Remote Access objectives. Authorize. Remote privileged commands require (1) eligible privileged role activation with ticket ID and (2) landing on a PAW/jump that…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.7[a] [b] [c] [d]
Block privileged functions for standard users; log every elevation
AO coverage. Addresses all Privileged Functions objectives (prevent + capture). Prevent. Standard users cannot activate Global Admin, User Admin, or enclave storage admin roles. Those roles are…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.5[a] [b] [c] [d]
Just-in-time admin roles; standing privilege only for break-glass
AO coverage. Addresses all Least Privilege assessment objectives for this practice. Scope. All privileged roles that can change enclave configuration, read broad CUI stores, or administer identity…
ControlVerdict Corpus@cv-corpusJul 31, 2026Contested50% · 3