SCENARIO 04 Zero Trust PIM Terraform

Zero Trust Rollout

Executive mandate to implement Zero Trust for a 1,000-person org within 30 days. Three workstreams: PIM Just-in-Time admin access replacing permanent roles, a four-policy Conditional Access suite, and all CA policies defined as Terraform infrastructure-as-code.

CA Policies PIM Terraform Zero Trust Architecture PowerShell Entra ID

Business Problem

Following a security assessment, IDSentinel Solutions' executive leadership issued a mandate to implement a Zero Trust access model across the organization. The assessment identified three critical gaps:

  • Gap 1No least-privilege enforcement — administrators held permanent privileged roles with no time limits or approval requirements
  • Gap 2No device compliance requirements — any device including personal and unmanaged devices could access corporate resources
  • Gap 3No location-based access controls — access was permitted from any geographic location with no risk-based evaluation

The CISO tasked the IAM team with designing and implementing a Zero Trust architecture to address all three gaps within 30 days.

Risk

  • Permanent admin access creates insider threat and credential theft risk
  • Unmanaged devices accessing sensitive data violates Zero Trust principles
  • No location controls means compromised credentials work from anywhere
  • Non-compliant with IDSentinel's cyber insurance requirements
  • Fails SOC 2 Type II access control requirements

Scope

FieldDetail
Affected populationAll ~1,000 employees and contractors
MandateExecutive-driven Zero Trust rollout, 30-day deadline
Target systemsMicrosoft Entra ID — Privileged Identity Management, Conditional Access, Terraform-managed policy
WorkstreamsJust-in-Time admin access (PIM), 4-policy Conditional Access suite, CA policies defined as Terraform code
Out of scopeNetwork-layer Zero Trust controls (segmentation, micro-perimeters) — identity layer only
Compliance driverCyber insurance requirements, SOC 2 Type II access control criteria

Zero Trust Principles Applied

PrincipleImplementation
Verify explicitlyMFA + device compliance required for all access
Use least privilegePIM Just-in-Time admin access replaces permanent roles
Assume breachNamed locations + sign-in risk policies limit blast radius

Solution Design

The Zero Trust rollout was implemented across three parallel workstreams:

WS 1

Just-in-Time Admin Access (PIM)

All privileged roles converted from permanent to eligible. Admins must request and justify access with time-limited 1-hour activation windows.

WS 2

Conditional Access Policy Suite

Four CA policies deployed — MFA enforcement, device compliance, risk-based sign-in blocking, and admin portal access restriction.

WS 3

Infrastructure as Code (Terraform)

All Conditional Access policies defined as Terraform code for repeatable, auditable, version-controlled deployment.

// diagrams/zero-trust-architecture.png — Zero Trust architecture diagram expand
Zero Trust architecture diagram

Implementation

Workstream 1 — PIM Just-in-Time Access

  • 01

    Convert Permanent Roles to Eligible

    All privileged roles (Global Admin, Security Admin, etc.) converted from permanent to PIM eligible assignments. Zero standing admin access outside of break-glass accounts.

    // 01-pim-eligible-assignments expand
    Privileged roles converted to PIM eligible assignments
  • 02

    Configure Activation Requirements

    PIM activation configured to require MFA verification, business justification entry, and a maximum 1-hour activation window with full audit logging.

    // 02-pim-activation-settings expand
    PIM activation settings — MFA, justification, 1-hour limit
  • 03

    Validate JIT Access Request Flow

    End-to-end tested from the IAM Engineer perspective — activated Security Administrator role via PIM with MFA challenge and business justification required. Role confirmed active for 1-hour window then automatically expired.

    // 03a-pim-access-request expand
    PIM access request with business justification
    // 03b-role-activated expand
    Role activated — confirmed for 1-hour window

Workstream 2 — Conditional Access Policy Suite

  • 04

    Policy 1 — Require MFA for All Users

    MFA required for all users on all cloud apps. No exclusions except break-glass accounts.

    // 04-ca-mfa-all-users expand
    CA Policy 1 — MFA required for all users
  • 05

    Policy 2 — Block High Risk Sign-ins

    Sign-ins at high risk level (Identity Protection) blocked outright. Medium risk challenged with MFA step-up.

    // 05-ca-block-risky-signins expand
    CA Policy 2 — block high-risk sign-ins
  • 06

    Policy 3 — Restrict Admin Portal Access

    Azure/Entra admin portals restricted to compliant, managed devices only — preventing admin access from personal or unmanaged endpoints.

    // 06-ca-admin-portals expand
    CA Policy 3 — admin portal access restricted to managed devices
    // 07-ca-policy-list-overview expand
    All CA policies — overview of enforced suite

Workstream 3 — Terraform as Code

  • 07

    Configure Terraform Entra Provider

    AzureAD Terraform provider configured with service principal authentication. terraform init run to initialize the working directory.

    // 08-terraform-init expand
    terraform init — provider initialized
  • 08

    Define CA Policies as Code

    All four Conditional Access policies defined in main.tf using the azuread_conditional_access_policy resource. terraform plan validated all resources before apply.

    // 09a-terraform-plan expand
    terraform plan — resources to be created
    // 09b-terraform-plan expand
    terraform plan — policy definitions
    // 09c-terraform-plan expand
    terraform plan — full validation output
  • 09

    Apply Infrastructure

    terraform apply deployed all CA policies to Entra ID. Policies confirmed active in Entra admin center — version-controlled and repeatable.

    // 10-terraform-apply expand
    terraform apply — infrastructure deployed
    // 11-terraform-policies-in-entra expand
    CA policies confirmed active in Entra admin center

Zero Trust Posture Validation

// 12-zero-trust-validation expand
Zero Trust posture validation — all controls confirmed active

Outcome

All privileged roles converted to PIM eligible — zero permanent admin assignments outside break-glass
PIM activation requires MFA, business justification, and 1-hour time limit with full audit logging
4 Conditional Access policies deployed — MFA, risk-based blocking, admin portal restriction, legacy auth block
All CA policies defined as Terraform code — fully version-controlled and repeatable
Zero Trust posture validated — all four CA policies confirmed active and enforced
Zero standing administrative access granted at any stage of implementation

Files