- \n
- Azure DevOps must be integrated with Azure Active Directory which is the key to enable PIM.<\/li>\n<\/ul>\n
Steps<\/h2>\n
1. Login to https:\/\/portal.azure.com<\/a>. Search for Azure Active Directory and click on the same. Select the Groups from left pane and click on Add to create a security group.\u00a0<\/p>\n
![\"Image](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2024\/02\/CreatePCA2.png\")
<\/a><\/p>\n2. Once the group is created, click on the group and select Privileged Identity Management and click on Enable Azure AD PIM for this group button as shown below.\u00a0<\/p>\n
![\"Image](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2024\/02\/EnablePIM3.png\")
<\/a><\/p>\n3. This will deploy PIM successfully for the group.<\/p>\n
![\"Image](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2024\/02\/SuccessfulPIMEnablement4.png\")
<\/a><\/p>\n4. Now select Eligible assignments tab and click on Add assignments to assign user (Demo User) to the group who can activate the PIM.<\/p>\n
![\"Image](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2024\/02\/ElgibleAssignment5.png\")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2024\/02\/AddAssignment6.png\")
<\/a><\/p>\n5. Once PIM is assigned, click on settings and click on Member -> Edit to add an Approver who would be eligible to approve the PIM request.<\/p>\n
![\"Image](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2024\/02\/Addapprover11.png\")
<\/a><\/p>\n6. Now, the PIM set up is complete in Azure AD and we need to add the security group\u00a0 \u00a0 for\u00a0which PIM is enabled to Project Collection Administrators role in Azure DevOps.<\/p>\n
![\"Image](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2024\/02\/PCArole12.png\")
<\/a>\u00a0 \u00a0<\/p>\nThis completes the overall PIM set up process and next step is to validate the PIM.<\/p>\n
Validate<\/h2>\n
1. The Demo User who has the PIM enabled needs to login to Azure portal and search for Azure AD Privileged Identity Management and click on the same. Select Groups from left pane and then click on the security group for which PIM is enabled.<\/p>\n
![\"Image](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2024\/02\/Demouser13.png\")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2024\/02\/Activate14.png\")
<\/a><\/p>\n2. User needs to Activate PIM with appropriate reason.<\/p>\n
![\"Image](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2024\/02\/Activate15access.png\")
<\/a><\/p>\n3. Once request is raised, a notification is sent to Approver. The approver can click on the link\u00a0 or login to Azure -> PIM -> Approve Requests -> Groups and select User to be approved.<\/p>\n
![\"Image](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2024\/02\/Approverequest16.png\")
<\/a><\/p>\n4. Now the approver (assuming that user is a Project Collection Admin) can login to Azure DevOps -> Organization Settings -> Permissions -> Project Collection Admin to check if the user (Demo User) is added to the security group and is reflecting ( just for the demo, here we show that user is available in the group. Generally user can login and check as in step 5)<\/p>\n
![\"Image](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2024\/02\/OrgAdmin18.png\")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2024\/02\/Enabled19.png\")
<\/a><\/p>\n