services / Azure / PIM role management policy

A PIM role management policy defines the activation rules and guardrails (MFA, approval, justification, maximum activation duration, notifications) governing how eligible principals activate privileged Azure roles.

Directly governs how privileged-role activation is controlled; weakening it enables tenant/subscription-wide privilege escalation, hence a CRITICAL-tier asset.

Microsoft.​Authorization/​roleManagementPolicies/​approvalRule/​action

Modifying the approval rule can remove the approver gate on privileged-role activation, enabling self-approved escalation and dismantling a key access-control defense.

Risks

1. Privilege escalation (CRITICAL)
2. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links