A manufacturing company needs to manage access to its operational technology (OT) systems from its corporate IT network. They want to ensure that only specific, authorized users can access these sensitive systems and that their access is limited to a defined time window. Additionally, they need to log all access attempts to the OT systems. Which Microsoft Entra capability, when integrated with a jump server or secure access workstation, helps enforce time-bound access and auditing for these highly sensitive resources?
- AMicrosoft Entra Identity Protection
- BMicrosoft Entra Entitlement Management
- CMicrosoft Entra Conditional Access
- DMicrosoft Entra Privileged Identity Management (PIM)
Show answer & explanationAnswer & explanation
Correct answer: D. Microsoft Entra Privileged Identity Management (PIM)
Microsoft Entra Privileged Identity Management (PIM) is crucial for managing highly sensitive access. By requiring users to activate a specific role for a limited time (just-in-time access) to access the jump server/secure workstation that then connects to OT systems, PIM enforces time-bound access and provides a detailed audit trail of when and by whom the privileged role was activated.
Why the other options are wrong
- A. Identity Protection detects identity-based risks but doesn't manage the time-bound activation or auditing of privileged roles for sensitive systems.
- B. Entitlement Management focuses on delegated access package management for general resources, not the specialized, time-bound, and audited access for privileged roles.
- C. Conditional Access can enforce conditions like MFA or compliant devices but doesn't inherently provide time-bound role activation with auditing specific to privileged access.
Microsoft Entra PIM for OT Access
Leveraging Microsoft Entra PIM to provide just-in-time, time-bound access to jump servers or secure workstations, which then connect to sensitive Operational Technology (OT) systems, ensuring strict control and auditing.
- Enforces temporary, just-in-time access for OT system users.
- Requires activation of a privileged role before accessing a jump server.
- Provides granular auditing of privileged access attempts and durations.
Memory trick: PIM is the time-locked vault key for your factory floor.