1

We are implementing PIM across our Azure setup and whilst it works well I cannot see a way to restrict access to the SQL databases in a way that allows a user to request elevation to access the database.

I was thinking we could use the "Active Directory admin" feature and add an AD group with only members who are allowed access to the database, but what I would like is that entry to that group has to be requested and authorised and then revoked automatically after a certain amount of time, but this doesn't seem possible.

My requirements are: 1. No default access to login to the database (unless a user already in the DB, of which there is no need for permermant access from human users) 2. Access can be requested and approved 3. Access is removed after a set period of time automatically

Is there a way that this can be achived?

I'm essentially looking for JIT like access that is provided for VMs.

2
  • did you find any answer? I'm looking for the exact same thing
    – Martin
    Sep 23, 2021 at 6:20
  • 1
    more or less - we use PIM's ability to permission AD groups, we then add those groups to our databases for the relevant role. So users PIM themselves for the AD group and get auto removed by PIM once finished.
    – mattb
    Sep 24, 2021 at 13:13

0

You must log in to answer this question.

Browse other questions tagged .