Book 04 — Access & Privilege

Conditional Access, privileged roles, applications and access governance: why every access decision is a policy decision, and how to run it

Book 04 of the Modernization Workbook: why access is a policy decision and why standing privilege fails, the Conditional Access model, privileged roles and tiers, applications and workload identities, who decides access, the Conditional Access policy library, PIM self-request with approval, access governance, and access as code with the evidence it produces.

Book 04 — Access & Privilege: Every Access Decision Is a Policy Decision

Status — draft book

This book consolidates the workbook’s access-plane pages (the Conditional Access policy library, PIM self-request with approval, the Conditional Access principles and their short companion pages) into one ordered book, and draws on the Federal Compliance books and the Help Desk guide for privileged access, application governance and access as code, which stay in place and are linked. Every external claim was checked against a primary source on October 20, 2026 and carries a footnote. The consolidated pages are kept in the repository’s archive/b04-access/ folder, and their old addresses forward to the chapters that replaced them.

Download and present

b04-access-bundle.docx: the whole book as one Word document, regenerated on every site deploy.

15-minute presentation: the Why / What / Who / How deck and its narrated, self-running version are in the repository under presentations/b04-access/.

Zero Trust moves every access decision to a policy engine and makes it on every request. In Microsoft Entra ID that engine is Conditional Access: it reads who is signing in, from what device, to what, with what risk, and decides block, grant, or grant with conditions. Access that used to follow from group membership and network location now follows from policy, so the policy library becomes the agency’s access control in practice. The same is true of privilege. A standing administrator is an open door; an eligible one, activated just in time with approval and a fresh strong sign-in, is a decision made and recorded each time. This book is the policy, the privilege model and the governance that keep both honest.

Why, what, who, how

	Question	Chapters
Why	Why is every access decision a policy decision, and why does standing privilege fail?	01, 02
What	What the policy engine evaluates, how privilege is structured, and how applications and workloads get access	03, 04, 05
Who	Who decides access and who does the work	06
How	The policy library, PIM with approval, access governance, and access as code with its evidence	07, 08, 09, 10

Appendices: A — Conditional Access policy templates · B — PIM role settings reference

Reading paths

Executives (20 minutes): Chapters 01, 02 and 06, or the 15-minute presentation.
Architects: Chapters 01–06, then 10.
Identity engineers: Chapters 03–05, then 07–09 with both appendices at hand.

Where this book sits in the workbook

This is Book 04 of the Modernization Workbook. It builds on Book 02 — Identity & Directory and Book 03 — HR-Driven Identity, whose attributes drive the policy targeting here, and it is the authoritative home of the Conditional Access library and the PIM settings that Book 02 introduces. For depth it links to the Federal Compliance books on privileged access management, native cloud IAM, identity and access as code, identity and access governance and app registration governance, to the Help Desk guide on enterprise application access, and to the Privileged Access project.

Chapters

Title	Description
Chapter 01 — Access Is a Policy Decision	Why Zero Trust turns every access request into a decision made against policy, how Conditional Access serves as that policy engine in Microsoft Entra ID, and what goes wrong when access is granted by group membership and network location instead.
Chapter 02 — Why Standing Privilege Fails	Why always-on administrative rights are the main path from one stolen credential to control of the estate, what least privilege requires under NIST SP 800-53 AC-6, how just-in-time and just-enough administration and governed break-glass accounts replace standing privilege, and the goals of the privileged-access project.
Chapter 03 — The Conditional Access Model	How Microsoft Entra Conditional Access evaluates a sign-in: assignments and conditions, grant and session controls, authentication strengths, report-only mode, exclusions and the evaluation order, plus the program’s baseline principles, naming convention and persona model.
Chapter 04 — Privileged Roles and Tiers	Which Microsoft Entra roles and cloud permissions are privileged, how the program sorts them into tiers built on Microsoft’s enterprise access model, how roles reach people through role-assignable groups and PIM for Groups, and the native cloud IAM, privileged access workstations and emergency access accounts that complete the model.
Chapter 05 — Applications and Workload Identities	How applications become principals in Microsoft Entra ID, how consent, ownership and credentials grant them access, and how the program governs app registrations, managed identities and federated workloads.
Chapter 06 — Who Decides Access	Who decides and who does the work for application and access changes: application owners, business approvers, the identity governance office, identity engineering, the help desk, security operations, the ISSO and the authorizing official, with the enterprise-application approval model and the help desk authority split.
Chapter 07 — The Conditional Access Policy Library	The program’s Conditional Access policy library: each policy’s intent, targeting, controls, exclusions, rollout from report-only through pilot to enforcement, and monitoring, reconciled with the Book 02 baseline set and mapped to CISA BOD 25-01.
Chapter 08 — PIM Self-Request with Approval	The operating model for approval-gated, just-in-time activation of Microsoft Entra administrative roles: eligibility, activation requirements, durations, approvers, notifications, alerts, access reviews, audit retention, assessment evidence and the FedRAMP Moderate control mapping.
Chapter 09 — Access Governance: Packages, Reviews and Lifecycle	How the program grants, re-confirms, and removes access over time: entitlement management catalogs, access packages and policies, access reviews, Lifecycle Workflows access tasks, guest access governance, and the evidence each produces.
Chapter 10 — Access as Code, and the Evidence It Produces	How the program holds Conditional Access, PIM settings, groups, access packages and access reviews as versioned code, applies them through change control, detects drift, and maps the resulting records to NIST SP 800-53 AC-2, AC-3, AC-6, IA-2 and CA-7.
Appendix A — Conditional Access Policy Templates	Microsoft Graph JSON templates for the Conditional Access policy library in Chapter 07, with the supporting named locations and authentication strength, a schema reference checked against the Graph v1.0 conditionalAccessPolicy resource, and an illustrative deployment script.
Appendix B — PIM Role Settings Reference	The program’s Privileged Identity Management role settings for each Microsoft Entra administrative role: tier, maximum activation, approval and approvers, authentication context, justification, ticket, eligibility expiry and notification recipients, with role template IDs.