mguard service workstation configuration

MGUARD SERVICE WORKSTATION CONFIGURATION HOW TO

For break-glass emergency access scenarios.

Assigned to administrative users and used for administrative purposes only.

Assigned to administrative users, but also used for non-administrative productivity purposes, like reading and responding to email.

Then, categorize the remaining accounts that are assigned to admin roles: Remove any accounts that are no longer needed in those roles.

How: After turning on Azure AD Privileged Identity Management, view the users who are in the following Azure AD roles:įor a complete list of administrator roles, see Administrator role permissions in Azure Active Directory. Who: This initiative is typically led by Identity and Key Management and/or Security Architecture. Why: This step is required to identify and minimize the number of people that require separate accounts and privileged access protection Additional specialized roles will be identified in later stages. What: Identify all roles and groups with high business impact that will require privileged security level (immediately or over time). Identify and categorize privileged accounts (Azure AD) Measure key results: 100% of applicable privileged access roles are using Azure AD PIM.How: Deploy and Configure Azure AD Privileged Identity Management using the guidance in the article, Deploy Azure AD Privileged Identity Management (PIM).Policy and standards team document clear requirements and standards (based on this guidance).Why: Privileged Identity Management provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions.What: Use Azure AD Privileged Identity Management (PIM) in your Azure AD production environment to discover and secure privileged accounts.Maintained Emergency access has been reviewed and tested within the past 90 daysĮnable Azure AD Privileged Identity Management.Established Emergency access process has been designed based on Microsoft guidance that meets organizational needs.How: Follow the guidance in Manage emergency access accounts in Azure AD.

Security Compliance management monitors to ensure compliance.Identity and Key Management or Central IT Operations to implement any changes.Policy and standards team document clear requirements and standards.Execution: This initiative is a collaborative effort involving.Sponsorship: This initiative is typically sponsored by CISO, CIO, or Director of Identity.Who: This initiative is typically led by Identity and Key Management and/or Security Architecture.Ensure you have a plan for continuity of access that accommodates both expected and unexpected events. Why: Emergency access accounts rarely used and highly damaging to the organization if compromised, but their availability to the organization is also critically important for the few scenarios when they are required.What: Ensure that you are not accidentally locked out of your Azure Active Directory (Azure AD) organization in an emergency situation.Separate and manage privileged accounts Emergency access accounts It is critical to create and maintain buy-in across the organization, without it many projects fail. It is critical to work together as an organization, create partnerships, and educate people who traditionally were not part of this process. Many of these initiatives will include members outside of the traditional IT Department that should be included in the decision making and implementation of these changes to ensure they are successfully integrated in your organization. Some items require changes to processes and people's knoweldge/skills, while others are simpler technology changes.

MGUARD SERVICE WORKSTATION CONFIGURATION HOW TO

Each item includes what (objective), why, who, how, and how to measure (key results). Learn more about Microsoft Secure Score in the article Secure score overview.Įach item in this RAMP is structured as an initiative that will be tracked and managed using a format that builds on the objectives and key results (OKR) methodology. This roadmap prioritizes stopping the accumulation of new security risks first, and then later cleans up the remaining items that have already accumulated.Īs you progress through the roadmap, you can utilize Microsoft Secure Score to track and compare many items in the journey with others in similar organizations over time. Many of these steps will have a green/brownfield dynamic as organizations often have security risks in the way they are already deployed or configured accounts.

Mguard service workstation configuration