Privileged access management in Office 365
This topic covers deployment and configuration guidance for features only currently available in Office 365 E5 and Advanced Compliance SKUs.
Privileged access management allows granular access control over privileged admin tasks in Office 365. It can help protect your organization from breaches that use existing privileged admin accounts with standing access to sensitive data or access to critical configuration settings. Privileged access management requires users to request just-in-time access to complete elevated and privileged tasks through a highly scoped and time-bounded approval workflow. This gives users just-enough-access to perform the task at hand, without risking exposure of sensitive data or critical configuration settings. Enabling privileged access management in Office 365 allows your organization to operate with zero standing privileges and provide a layer of defense against standing administrative access vulnerabilities.
For a quick overview of the integrated Customer Lockbox and privileged access management workflow, see this Customer Lockbox and privileged access management in Office 365 video.
Layers of protection
Privileged access management complements other data and access feature protections within the Office 365 security architecture. Including privileged access management as part of an integrated and layered approach to security provides a security model that maximizes protection of sensitive information and Office 365 configuration settings. As shown in the diagram, privileged access management builds on the protection provided with native encryption of Office 365 data and the role-based access control security model of Office 365 services. When used with Azure AD Privileged Identity Management, these two features provide access control with just-in-time access at different scopes.
Privileged access management in Office 365 is defined and scoped at the task level, while Azure AD Privileged Identity Management applies protection at the role level with the ability to execute multiple tasks. Azure AD Privileged Identity Management primarily allows managing accesses for AD roles and role groups, while privileged access management in Office 365 applies only at the task level.
Enabling privileged access management in Office 365 while already using Azure AD Privileged Identity Management: Adding privileged access management in Office 365 provides another granular layer of protection and audit capabilities for privileged access to Office 365 data.
Enabling Azure AD Privileged Identity Management while already using privileged access management in Office 365: Adding Azure AD Privileged Identity Management to privileged access management in Office 365 can extend privileged access to data outside of Office 365 that’s primarily defined by user roles or identity.
Privileged access management architecture and process flow
Each of the following process flows outline the architecture of privileged access and how it interacts with the Office 365 substrate, Office 365 auditing, and the Exchange Management runspace.
Step 1: Configure a privileged access policy
When you configure a privileged access policy with the Microsoft 365 admin center or the Exchange Management PowerShell, you define the policy and the privileged access feature processes and the policy attributes in the Office 365 substrate. The activities are logged in the Office 365 Security and Compliance Center. The policy is now enabled and ready to handle incoming requests for approvals.
Step 2: Access request
In the Microsoft 365 admin center or with the Exchange Management PowerShell, users can request access to elevated or privileged tasks. The privileged access feature sends the request to the Office 365 substrate for processing against the configured privilege access policy and records the Activity in the Office 365 Security and Compliance Center logs.
Step 3: Access approval
An approval request is generated and the pending request notification is emailed to approvers. If approved, the privileged access request is processed as an approval and the task is ready to be completed. If denied, the task is blocked and no access is granted to the requestor. The requestor is notified of the request approval or denial via email message.
Step 4: Access processing
For an approved request, the task is processed by the Exchange Management runspace. The approval is checked against the privileged access policy and processed by the Office 365 substrate. All activity for the task is logged in the Office 365 Security and Compliance Center.
Frequently asked questions
What SKUs can use privileged access in Office 365?
Privileged access management is available for customers with Office 365 E5 and Advanced Compliance SKUs.
When will privileged access support Office 365 workloads beyond Exchange?
Privileged access management will be available in other Office 365 workloads soon. Visit the Microsoft 365 Roadmap for more details.
My organization needs more than 30 privileged access policies, will this limit be increased?
Yes, raising the current limit of 30 privileged access policies per Office 365 organization is on the feature roadmap.
Do I need to be a Global Admin to manage privileged access in Office 365?
No, you need the Exchange Role Management role assigned to accounts that manage privileged access in Office 365. If you don’t want to configure the Role Management role as a stand-alone account permission, the Global Administrator role includes this role by default and can manage privileged access. Users included in an approvers’ group don't need to be a Global Admin or have the Role Management role assigned to review and approve requests.
How is privileged access management in Office 365 related to Customer Lockbox?
Customer Lockbox allows a level of access control for organizations when Microsoft accesses data. Privileged access management in Office 365 allows granular access control within an organization for all Office 365 privileged tasks.
Ready to get started?