Get started with privileged access management
This article guides you through enabling and configuring privileged access management in your organization. You can use either the Microsoft 365 admin center or Exchange Management PowerShell to manage and use privileged access.
Tip
If you're not an E5 customer, use the 90-day Microsoft Purview solutions trial to explore how additional Purview capabilities can help your organization manage data security and compliance needs. Start now at the Microsoft Purview trials hub. Learn details about signing up and trial terms.
Before you begin
Before you get started with privileged access management, you should confirm your Microsoft 365 subscription and any add-ons.
Before you get started with privileged access management, you should confirm your Microsoft 365 subscription and any add-ons. To access and use privileged access management, your organization must have supporting subscriptions or add-ons. For more information, see the subscription requirements for privileged access management.
If you don't have an existing Office 365 Enterprise E5 plan and want to try privileged access management, you can add Microsoft 365 to your existing Office 365 subscription or sign up for a trial of Microsoft 365 Enterprise E5.
Enable and configure privileged access management
Follow these steps to set up and use privileged access in your organization:
Step 1: Create an approver's group
Before you start using privilege access, determine who needs approval authority for incoming requests for access to elevated and privileged tasks. Any user who is part of the Approvers' group is able to approve access requests. This group is enabled by creating a mail-enabled security group in Office 365.
Step 2: Enable privileged access
Privileged access must be explicitly enabled in Office 365 with the default approver group, including a set of system accounts that you want excluded from the privileged access management access control.
Step 3: Create an access policy
Creating an approval policy allows you to define the specific approval requirements scoped at individual tasks. The approval type options are Auto or Manual.
Step 4: Submit/approve privileged access requests
Once enabled, privileged access requires approvals for any task that has an associated approval policy defined. For tasks included in an approval policy, users must request and be granted access approval to have permissions necessary to execute the task.
After approval is granted, the requesting user can execute the intended task and privileged access will authorize and execute the task on behalf of the user. The approval remains valid for the requested duration (default duration is 4 hours), during which the requester can execute the intended task multiple times. All such executions are logged and made available for security and compliance auditing.
Note
If you want to use Exchange Management PowerShell to enable and configure privileged access, follow the steps in Connect to Exchange Online PowerShell using Multi-Factor authentication to connect to Exchange Online PowerShell with your Office 365 credentials. You do not need to enable multi-factor authentication for your organization to use the steps to enable privileged access while connecting to Exchange Online PowerShell. Connecting with multi-factor authentication creates an Auth Token that is used by privileged access for signing your requests.
Step 1: Create an approver's group
Sign into the Microsoft 365 admin center using credentials for an admin account in your organization.
In the admin center, go to Groups > Add a group.
Select mail-enabled security group and then complete the Name, Group email address, and Description fields for the new group.
Save the group. It may take a few minutes for the group to be fully configured and to appear in the Microsoft 365 admin center.
Select the new approver's group and select edit to add users to the group.
Save the group.
Step 2: Enable privileged access
In the Microsoft 365 Admin Center
Sign into the Microsoft 365 Admin Center using credentials for an admin account in your organization.
In the admin center, go to Settings > Org Settings > Security & Privacy > Privileged access.
Enable the Require approvals for privileged tasks control.
Assign the approver's group you created in Step 1 as the Default approvers group.
Save and Close.
In Exchange Management PowerShell
To enable privileged access and to assign the approver's group, run the following command in Exchange Online PowerShell:
Enable-ElevatedAccessControl -AdminGroup '<default approver group>' -SystemAccounts @('<systemAccountUPN1>','<systemAccountUPN2>')
Example:
Enable-ElevatedAccessControl -AdminGroup 'pamapprovers@fabrikam.onmicrosoft.com' -SystemAccounts @('sys1@fabrikamorg.onmicrosoft.com', 'sys2@fabrikamorg.onmicrosoft.com')
Note
System accounts feature is made available to ensure certain automations within your organizations can work without dependency on privileged access, however it is recommended that such exclusions be exceptional and those allowed should be approved and audited regularly.
Step 3: Create an access policy
You can create and configure up to 30 privileged access policies for your organization.
In the Microsoft 365 Admin Center
Sign into the Microsoft 365 Admin Center using credentials for an admin account in your organization.
In the Admin Center, go to Settings > Org Settings > Security & Privacy > Privileged access.
Select Manage access policies and requests.
Select Configure policies and select Add a policy.
From the drop-down fields, select the appropriate values for your organization:
Policy type: Task, Role, or Role Group
Policy scope: Exchange
Policy name: Select from the available policies
Approval type: Manual or Auto
Approval group: Select the approvers group created in Step 1
Select Create and then Close. It may take a few minutes for the policy to be fully configured and enabled.
In Exchange Management PowerShell
To create and define an approval policy, run the following command in Exchange Online PowerShell:
New-ElevatedAccessApprovalPolicy -Task 'Exchange\<exchange management cmdlet name>' -ApprovalType <Manual, Auto> -ApproverGroup '<default/custom approver group>'
Example:
New-ElevatedAccessApprovalPolicy -Task 'Exchange\New-MoveRequest' -ApprovalType Manual -ApproverGroup 'mbmanagers@fabrikamorg.onmicrosoft.com'
Step 4: Submit/approve privileged access requests
Requesting elevation authorization to execute privileged tasks
Requests for privileged access are valid for up to 24 hours after the request is submitted. If not approved or denied, the requests expire and access isn't approved.
In the Microsoft 365 Admin Center
Sign into the Microsoft 365 Admin Center using your credentials.
In the Admin Center, go to Settings > Org Settings > Security & Privacy > Privileged access.
Select Manage access policies and requests.
Select New request. From the drop-down fields, select the appropriate values for your organization:
Request type: Task, Role, or Role Group
Request scope: Exchange
Request for: Select from the available policies
Duration (hours): Number of hours of requested access. There isn't a limit on the number of hours that can be requested.
Comments: Text field for comments related to your access request
Select Save and then Close. Your request is sent to the approver's group via email.
In Exchange Management PowerShell
Run the following command in Exchange Online PowerShell to create and submit an approval request to the approver's group:
New-ElevatedAccessRequest -Task 'Exchange\<exchange management cmdlet name>' -Reason '<appropriate reason>' -DurationHours <duration in hours>
Example:
New-ElevatedAccessRequest -Task 'Exchange\New-MoveRequest' -Reason 'Attempting to fix the user mailbox error' -DurationHours 4
View status of elevation requests
After an approval request is created, elevation request status can be reviewed in the admin center or in Exchange Management PowerShell using the associated with request ID.
In the Microsoft 365 admin center
Sign into the Microsoft 365 admin center with your credentials.
In the admin center, go to Settings > Org Settings > Security & Privacy > Privileged access.
Select Manage access policies and requests.
Select View to filter submitted requests by Pending, Approved, Denied, or Customer Lockbox status.
In Exchange Management PowerShell
Run the following command in Exchange Online PowerShell to view an approval request status for a specific request ID:
Get-ElevatedAccessRequest -Identity <request ID> | select RequestStatus
Example:
Get-ElevatedAccessRequest -Identity 28560ed0-419d-4cc3-8f5b-603911cbd450 | select RequestStatus
Approving an elevation authorization request
When an approval request is created, members of the relevant approver group receive an email notification and can approve the request associated with the request ID. The requestor is notified of the request approval or denial via email message.
In the Microsoft 365 admin center
Sign into the Microsoft 365 admin center with your credentials.
In the admin center, go to Settings > Org Settings > Security & Privacy > Privileged access.
Select Manage access policies and requests.
Select a listed request to view the details and to take action on the request.
Select Approve to approve the request or select Deny to deny the request. Previously approved requests can have access revoked by selecting Revoke.
In Exchange Management PowerShell
To approve an elevation authorization request, run the following command in Exchange Online PowerShell:
Approve-ElevatedAccessRequest -RequestId <request id> -Comment '<approval comment>'
Example:
Approve-ElevatedAccessRequest -RequestId a4bc1bdf-00a1-42b4-be65-b6c63d6be279 -Comment '<approval comment>'
To deny an elevation authorization request, run the following command in Exchange Online PowerShell:
Deny-ElevatedAccessRequest -RequestId <request id> -Comment '<denial comment>'
Example:
Deny-ElevatedAccessRequest -RequestId a4bc1bdf-00a1-42b4-be65-b6c63d6be279 -Comment '<denial comment>'
Delete a privileged access policy in Office 365
If it's no longer needed in your organization, you can delete a privileged access policy.
In the Microsoft 365 admin center
Sign into the Microsoft 365 admin center using credentials for an admin account in your organization.
In the admin center, go to Settings > Org Settings > Security & Privacy > Privileged access.
Select Manage access policies and requests.
Select Configure policies.
Select the policy you want to delete, then select Remove Policy.
Select Close.
In Exchange Management PowerShell
To delete a privileged access policy, run the following command in Exchange Online PowerShell:
Remove-ElevatedAccessApprovalPolicy -Identity <identity GUID of the policy you want to delete>
Disable privileged access in Office 365
If needed, you can disable privileged access management for your organization. Disabling privileged access doesn't delete any associated approval policies or approver groups.
In the Microsoft 365 admin center
Sign into the Microsoft 365 admin center with credentials for an admin account in your organization.
In the Admin Center, go to Settings > Org Settings > Security & Privacy > Privileged access.
Enable the Require approvals for privileged access control.
In Exchange Management PowerShell
To disable privileged access, run the following command in Exchange Online PowerShell:
Disable-ElevatedAccessControl