Week 2, Day 4 — SSPR & Privileged Identity Management

Day 3 review & two remaining gaps

• Quick check: "Name the four CA policies created yesterday. What is the control applied by each?" — from memory, no notes
• Ask: "Lakeview Logistics has MFA and CA policies — but what happens when a user forgets their password at 10pm when IT is closed? Who resets it?" — surface the SSPR gap
• Ask: "Sarah Chen has User Administrator permanently assigned. She uses those permissions maybe twice a week. Is that the right model?" — surface the standing privilege gap that PIM addresses
• Frame the day: two topics, different scale — SSPR is a practical operational improvement that reduces helpdesk load immediately; PIM is an architectural shift in how admin access works and is the gold standard for privileged account protection

SSPR and PIM — self-service recovery and just-in-time access

Two very different problems, both rooted in the same principle: the right access, to the right people, at the right time, with the right oversight. SSPR applies that to password recovery. PIM applies it to admin roles.

• Self-Service Password Reset (SSPR) — what it is — SSPR lets users reset their own passwords and unlock their own accounts without contacting IT. It verifies identity through authentication methods the user has pre-registered — mobile app notification, email, phone, security questions. When correctly configured, it dramatically reduces helpdesk ticket volume and gives users 24/7 account recovery.
• SSPR configuration decisions admins make:

• Privileged Identity Management (PIM) — the problem it solves — standing privilege is when an admin has a role permanently assigned, whether they are using it or not. Every minute that role is permanently active is a window of risk — if that account is compromised, the attacker has unlimited admin access immediately. PIM eliminates standing privilege by making roles eligible rather than permanent: a user activates the role when needed, uses it, and it expires. Outside those windows, the account has no admin permissions.
• PIM key concepts:

• PIM licence note — Entra ID P2 required — PIM requires Entra ID P2 (included in E5, not in Business Standard or E3). Students will explore the PIM interface and configure settings today, but activation and approval workflows will not function on Business Standard. Everything configured today will be validated when E5 is added in Week 5.
• The broader identity governance picture — PIM is part of Entra ID Governance, which also includes access packages, entitlement management, and lifecycle workflows. Week 2 introduces the concept; deeper governance topics will come up again in the compliance and security weeks.

Lab 2-D: Configuring SSPR and exploring PIM for Lakeview Logistics

The lab splits into two halves — SSPR (fully functional on Business Standard, 25 min) and PIM (architecture and configuration, 35 min). SSPR is tested end-to-end. PIM is configured and the interface is explored in depth, with activation testing deferred to Week 5.

• Step 1 — Enable and configure SSPR (15 min)
  Navigate to entra.microsoft.com → Protection → Password reset. Configure SSPR with the following settings:
  
  · Self service password reset enabled: All
  · Number of methods required to reset: 2
  · Methods available: Mobile app notification ✓ · Mobile app code ✓ · Email ✓ · Mobile phone ✓ · Office phone ✗ · Security questions ✗
  · Registration → Require users to register when signing in: Yes
  · Registration → Number of days before users are asked to re-confirm: 180
  · Notifications → Notify users on password resets: Yes
  · Notifications → Notify all admins when other admins reset their password: Yes
  
  Click Save. Record the configuration in your Lab Journal.
• Step 2 — Register SSPR methods for your admin account (10 min)
  Navigate to aka.ms/ssprsetup and sign in with your Global Admin account. Complete SSPR method registration — register both Microsoft Authenticator and a backup email address. Record registered methods in your Lab Journal.
• Step 3 — Test SSPR end-to-end (10 min)
  Sign out of all M365 sessions. Navigate to aka.ms/sspr. Enter your Global Admin UPN. Complete the identity verification challenge — you will receive an Authenticator push or an email code depending on your registered methods. Complete the reset flow (you can reset to the same password). Record the complete flow in your Lab Journal — every screen, every prompt, every verification step.
• Step 4 — Review the SSPR activity report (5 min)
  Navigate to entra.microsoft.com → Protection → Password reset → Audit logs. Locate your test reset event. Record: the event type, the user, the verification methods used, and the result.
• Step 5 — Explore the PIM interface and configure role settings (20 min)
  Navigate to entra.microsoft.com → Identity governance → Privileged Identity Management → Entra roles.
  
  Note the current state — on Business Standard you may see a licence prompt or a limited view. Document what you see.
  
  Navigate to Roles → User Administrator → Settings. Review and configure the activation settings:
  · Activation maximum duration: 4 hours
  · On activation: require MFA: Yes
  · On activation: require justification: Yes
  · Require approval to activate: Yes → set Sarah Chen as approver
  · Assignment: allow permanent eligible assignment: No
  · Assignment: expire eligible assignments after: 365 days
  
  Navigate to Assignments → Add assignments. Add Sarah Chen as an eligible (not active) User Administrator. Add Dev Sharma as an eligible Helpdesk Administrator.
• Step 6 — Explore PIM activation flow (10 min)
  Navigate to My roles in PIM as your Global Admin account. Observe what eligible role assignments appear. Click Activate on any eligible role and walk through the activation form — review the justification field, the MFA requirement, and the duration selector. Do not complete the activation unless it succeeds — document what happens and any licence restriction messages shown.

⭐ Bonus: PIM access reviews & SSPR reporting via PowerShell

Reflection & preview

• Ask: "SSPR is enabled for all users and requires 2 methods. A user only has one method registered and forgets their password. What happens when they try to use SSPR?" — surface the registration gap problem
• Ask: "You configured Sarah Chen as eligible for User Administrator in PIM rather than actively assigned. What is her admin access right now, at this moment?" — answer: none until she activates. This is the point.
• Ask: "PIM requires approval for User Administrator activation and Sarah Chen is the approver. Sarah needs to activate User Administrator. Who approves it?" — surface the approver chain design problem, a real operational consideration
• Collect exit ticket: describe the difference between an eligible and active PIM assignment, and explain why eligible is preferable for most admin roles
• Preview Day 5: Week 2 assessment — a simulated identity security incident at Lakeview Logistics. Students will investigate what happened, remediate the damage, and document the response. Come with all lab work complete and Lab Journals up to date.