services / Azure / PIM role management policy

A PIM role management policy defines the activation rules and guardrails (MFA, approval, justification, maximum activation duration, notifications) governing how eligible principals activate privileged Azure roles.

Directly governs how privileged-role activation is controlled; weakening it enables tenant/subscription-wide privilege escalation, hence a CRITICAL-tier asset.

Microsoft.​Authorization/​roleManagementPolicies/​write

Updating the policy lets an attacker remove MFA/approval/justification requirements or extend activation durations on privileged roles, easing privilege escalation and disabling the defensive controls guarding PIM activation.

Risks

1. Privilege escalation (CRITICAL)
2. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links