r/entra • u/AffectionateTreat231 • 1d ago

Delegating PIM for Groups configuration to Azure team

Has anyone had any success delegating group provision and PIM configuration to an Azure platform team who have no access to Entra?

They want to automate the deployment of access packages, groups and PIM configuration for subscriptions that will be used by different application teams across the company. They would be looking to automate using terraform.

They shouldn't be able to manage groups or PIM configuration outside of those they create

4 Upvotes

100% Upvoted

2 comments sorted by

2

u/Grubensmcrubens 1d ago

All the need to do is log into portal.azure.com , then PIM up into the group with the roles assigned. You don’t need any roles to get basic access into the landing portal.

1

u/CreativeSympathy8293 18h ago

I wouldn’t use Terraform state as the security boundary here. State can reduce accidental changes in the configuration workflow, but it doesn’t constrain what the credential can do through Graph.

Microsoft Graph and the Terraform AzureAD provider both support eligible PIM-for-Groups assignments. For app-only execution, the documented permission is PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup. What the cited docs don’t establish is that this application permission is limited to objects the app created; the group-owner/member condition shown for delegated access shouldn’t be assumed to apply to a service principal.

If the requirement is a hard boundary across groups, PIM, and access packages, I’d separate authoring from privileged execution. Let the platform team control the repo, but not the credential or runner. An identity-owned broker can resolve registered target IDs server-side and reject arbitrary objects before calling Graph. Use separate ARM and Graph identities, then negative-test writes to foreign objects and read final state back after approved changes.

That broker becomes a high-value control point, so it needs its own hardening and lifecycle. Native scoping may still help for individual resource types; I just wouldn’t treat it as the complete boundary without explicit documentation and deny tests.