You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The subscription owner group gets assigned to the subscription when we run the governance module.
That is great but we also need to support PIM and just in time access.
Could we create a new group that we call something like: az-sub-lzms-prod-owner-pim. but don't assign it to the subscription.
Instead configure PIM that that group is eligible for the subscription using the new group.
We should be able to keep all the existing groups and this shouldn't bee a breaking change. We might need to check if the AAD got a high enough license so we can use PIM.
If that is not easy we can use a global variable.
The text was updated successfully, but these errors were encountered:
The subscription owner group gets assigned to the subscription when we run the governance module.
That is great but we also need to support PIM and just in time access.
Could we create a new group that we call something like:
az-sub-lzms-prod-owner-pim
. but don't assign it to the subscription.Instead configure PIM that that group is eligible for the subscription using the new group.
We should be able to keep all the existing groups and this shouldn't bee a breaking change. We might need to check if the AAD got a high enough license so we can use PIM.
If that is not easy we can use a global variable.
The text was updated successfully, but these errors were encountered: