The False Sense of Security: Defense Becoming a Vulnerability

The False Sense of Security: Defense Becoming a Vulnerability

Speakers: Nathan Eades

Conference: fwd:cloudsec North America 2025

YouTube: https://www.youtube.com/watch?v=eq2FY0PPUow

Overview

Nathan Eades delivered a sharp critique of how Privileged Identity Management (PIM) and Just-In-Time (JIT) access in Microsoft Entra ID have created a false sense of security that often undermines the very least-privilege goals they were designed to serve. Drawing from extensive data across multiple real-world tenants, Eades demonstrated that PIM deployments frequently result in excessive noise, rubber-stamp approvals, meaningless justifications, and a dangerous loss of visibility — particularly when Microsoft's own best practice of "PIM for Groups" is followed. The talk is a wake-up call for any organization that has deployed PIM and assumed the job of privilege management was done.

Background

▶ Watch: Introduction to PIM and just-in-time access theory (1:30)

The journey from least privilege to Just-In-Time access to Privileged Identity Management represents a logical progression in identity security. Least privilege establishes that identities should have the minimum necessary permissions. JIT access adds time-bounding to that principle — standing privileges are removed and granted only when needed. PIM is Microsoft's implementation of JIT access for Entra ID, providing time-bound role activation, audit trails, justification requirements, and optional approval workflows.

The theory is sound. In practice, Eades found that the gap between PIM's promise and its operational reality has created conditions where security teams believe they have strong privilege controls while the actual implementation provides minimal effective defense. The problem is not that PIM is a bad tool — it is that organizations deploy it without following through on the operational discipline it requires.

Key Findings

▶ Watch: 50,000 justifications analyzed — most score 1 out of 8 (6:00)

Activation frequency creates unsustainable noise. Analyzing multiple tenants, Eades found users activating roles an average of 17 to 32 times per week across 2 to 5 working days. For service desk personnel who need User Administrator or Exchange Administrator roles as part of their daily work, short activation durations (1 hour) force constant reactivation. This volume of activation events makes security alerting on privilege escalation effectively useless.

Justifications are meaningless. Eades analyzed approximately 50,000 PIM justifications using a rubric where a score of 1 simply means the justification exists. The vast majority scored 1 — entries like "me," "work," "IM," or "SD." Justifications only became informative at scores of 5 or higher, and no justification in the dataset reached the maximum score of 8. Real-world justifications included single-character entries and obviously useless text.

Approval processes become rubber stamps. With users activating roles 32 times per week, approval fatigue is inevitable. The fastest approval time Eades observed was 20 seconds, with an average of 15 minutes. Approvers are barely reviewing requests.

75% of eligible roles go unused over 90 days. Across the tenants analyzed, roughly three-quarters of PIM-eligible role assignments showed no activation in a 90-day window. One role had to be traced back 363 days to find its last activation. PIM eligibility is being used as a security blanket — "it's not assigned, it's just eligible" — while actual least privilege is ignored.

PIM for Groups destroys visibility. Microsoft's own recommendation to use PIM for Groups — where users activate group membership to receive all roles assigned to that group at once — eliminates per-role activation logging. When a user activates their group membership, Microsoft logs only the group activation, not which specific roles were included. Worse, Microsoft failed to log direct group membership additions through the standard Groups interface, allowing PIM to be bypassed entirely without generating PIM audit events.

Technical Deep Dive

▶ Watch: PIM for Groups logging gap — Microsoft forgot to log direct additions (11:30)

The core visibility gap with PIM for Groups works as follows: administrators assign multiple roles permanently to a group, then make users eligible for that group. When a user activates their group membership, they receive every role attached to the group simultaneously. The audit log records only "member activated their group membership" — it does not enumerate which roles were included.

This creates a cascading problem. First, scope creep occurs as additional roles are added to existing groups ("Exchange admins also need Teams and SharePoint access"). Then other teams request access to those same groups rather than creating new ones. Groups can be nested into other groups, further obscuring the actual privilege surface.

The bypass vulnerability is worse. Microsoft's logging did not account for the scenario where an administrator simply adds a user directly to a PIM-managed group through the standard Entra groups interface (Members or Owners). This action generates only a standard "Add member to group" log entry with no PIM awareness. The PIM-managed status of the group is invisible in this code path.

Eades also identified that PIM's MFA requirement is weaker than it appears. The default "Azure MFA" setting only checks whether MFA was completed in the current session — typically within the last 10-20 minutes. If a user logged in with MFA, they can activate privileged roles without any additional authentication challenge. The fix requires switching to Microsoft Entra Conditional Access Authentication Context with a corresponding Conditional Access policy that forces step-up authentication using a stronger factor (such as FIDO2 hardware tokens or certificate-based authentication) specifically for role activation.

Demo / Proof of Concept

▶ Watch: 75% of eligible roles unused over 90 days across tenants (14:00)

Eades walked through a live demonstration of the PIM role activation workflow, showing the typical user experience of selecting a role, choosing the default duration, typing a minimal justification, and activating — a process that takes approximately 25 seconds. He also showed the role policy configuration options and the data visualizations of activation patterns across tenants.

Defensive Implications

▶ Watch: MFA step-up with Conditional Access Authentication Context (18:00)

Organizations using PIM should immediately audit their actual deployment against these findings:

Reverse the PIM for Groups pattern. Instead of assigning roles permanently to a group and making users eligible for the group, assign roles as eligible to the group and permanently assign users to the group. This forces individual role activation and restores per-role logging visibility.

Enable Authentication Context for privileged roles. Switch from the default "Azure MFA" requirement to Conditional Access Authentication Context that forces step-up authentication with a stronger factor (FIDO2, CBA) specifically for privilege activation.

Track group membership changes independently of PIM. Because PIM does not log direct group additions, organizations must separately monitor the standard Entra group membership events for any PIM-managed groups.

Conduct access reviews on eligible roles. With 75% of eligible roles unused over 90 days, organizations should aggressively review and revoke unused eligibility rather than treating "eligible" as an acceptable standing state.

Follow up on justifications and ticket numbers. If your organization requires justification or ticket numbers for PIM activation, someone must actually validate that the tickets exist, match the role being activated, and were created recently. Otherwise the control is pure theater.

Key Takeaways

• PIM eligibility is not least privilege: Organizations are using "eligible" as a euphemism for "assigned" while ignoring that 75% of eligible roles go unused for 90+ days.
• PIM for Groups eliminates per-role visibility: Microsoft's own recommended pattern removes the ability to see which specific roles a user activated, and fails to log direct group membership changes.
• Justifications and approvals are security theater without follow-through: 50,000 justifications analyzed showed the vast majority are single-word entries; the fastest approval was 20 seconds.
• MFA at activation requires explicit step-up configuration: The default PIM MFA setting does not actually force re-authentication if MFA was recently completed.
• The unglamorous work matters most: Access reviews, entitlement management, and actual least-privilege enforcement are more valuable than deploying PIM and walking away.

About the Speaker(s)

Nathan Eades works in cloud security with extensive experience across multiple Microsoft Entra ID tenants. He has deep expertise in Privileged Identity Management deployments and indicated plans to release KQL queries and tooling to help defenders audit their PIM configurations in their own environments. He mentioned Permiso's early work tracking Scattered Spider as context for the evolving threat landscape around identity attacks.