[{"content":"The topic I\u0026rsquo;m about to discuss sits at the edge of Compliance, Information Protection and Identity and Access Management (IAM). Let\u0026rsquo;s assume you already implemented Microsoft Purview Information Protection labeling. You have a label called top secret, and it encrypts the file when it\u0026rsquo;s assigned. The user did not share it with anybody and left the company. How do you gain access to the file and it\u0026rsquo;s content that is encrypted? This is where super users come to the picture. \u0026ldquo;The super user feature of the Azure Rights Management service from Microsoft Purview Information Protection ensures that authorized people and services can always read and inspect the data that Azure Rights Management encrypts for your organization. If necessary, the encryption protection can then be removed or changed.\u0026quot;[1] This feature is not enabled by default, so if you want to take advantage of it you\u0026rsquo;ll need to set it up first. There is a way to configure super users without compromising on zero trust, and this is what I\u0026rsquo;m going to show you.\nWarning Currently PowerShell 7 isn\u0026rsquo;t supported by the Microsoft Purview Information Protection Client. Using PS7 results in the error: \u0026ldquo;Object reference not set to an instance of an object.í First, you need an elevated PowerShell session. Then run the following command to install the necessary module:\n1Install-Module -Name AIPService Once the module is on your machine, you need to connect to the service\n1Import-Module AIPService 1Connect-AIPService If this it the first time you use the Azure Rights Management, you need to enable the super user feature\n1Enable-AipServiceSuperUserFeature To verify, that the action was performed corretly, you can run the following command. \u0026ldquo;Enabled\u0026rdquo; is the expected value for a successful feature enablement.\n1Get-AipServiceSuperUserFeature Now that the feature is turned on, we can set up a dedicated super user group in EntraID. You must enable the \u0026ldquo;Microsoft Entra roles can be assigned to the group\u0026rdquo; option, like you can see it in the screenshot Once the group is created, you should open it and click on the Privileged Identity Management option for the group. By default, the owner of the group (who created it) will be assigned to the group as an active assignment. To comply with the zero trust principles, you may remove that active assignment and use only eligible ones. You have to add your dedicated users as an eligible assignment. Note, that the maximum eligible assignment is one year. Since we have now a dedicated EntraID group for our super users, we can assign this group to the super user role for Purview. We\u0026rsquo;ll need to switch back to powershell again.\n1Set-AipServiceSuperUserGroup -GroupEmailAddress yournewgroup@yourtenant.com You\u0026rsquo;ll get a verification message in powershell upon successful execution, but if you want to be extra certain, you can run the following command:\n1Get-AipServiceSuperUserGroup That\u0026rsquo;s it. We achieved to give a user permission to decrypt or change encryption on files using Just-In-Time access. The user that is eligible for the group can activate the membership under Privileged Identity Management \u0026gt; My roles \u0026gt; Groups. In my experience, it takes time for the role to take effect, for me it was almost 1 hour before the super user permissions were kicked in.\nReference [1]: https://learn.microsoft.com/en-us/purview/encryption-super-users\n","permalink":"https://gaborszekeres.com/blog/set-up-jit-access-for-super-users-in-purview/","summary":"\u003cp\u003eThe topic I\u0026rsquo;m about to discuss sits at the edge of Compliance, Information Protection and Identity and Access Management (IAM). Let\u0026rsquo;s assume you already implemented Microsoft Purview Information Protection labeling. You have a label called top secret, and it encrypts the file when it\u0026rsquo;s assigned. The user did not share it with anybody and left the company. How do you gain access to the file and it\u0026rsquo;s content that is encrypted? This is where super users come to the picture. \u0026ldquo;The super user feature of the Azure Rights Management service from Microsoft Purview Information Protection ensures that authorized people and services can always read and inspect the data that Azure Rights Management encrypts for your organization. If necessary, the encryption protection can then be removed or changed.\u0026quot;[1] This feature is not enabled by default, so if you want to take advantage of it you\u0026rsquo;ll need to set it up first. There is a way to configure super users without compromising on zero trust, and this is what I\u0026rsquo;m going to show you.\u003c/p\u003e","title":"Set up JIT Access for super users in Purview"},{"content":"Hi, I\u0026rsquo;m Gabor I\u0026rsquo;ve worked in information security since January 2019, always in hands-on technical roles. My day-to-day is spent in the details — configuring, testing, breaking, and hardening real systems — and that\u0026rsquo;s exactly what I write about here.\nWhat I write about This blog covers Microsoft cloud security and AI security. Expect practical, reproducible write-ups on topics like:\nMicrosoft Entra ID — identity protection, Conditional Access, privileged access Azure and Microsoft 365 security Microsoft Purview and data security The emerging attack surface around AI systems Every post aims to be something a fellow practitioner can actually follow: concrete steps, real commands and code, screenshots, and the caveats that only show up once you\u0026rsquo;ve done it for real.\nWhy it\u0026rsquo;s grounded I don\u0026rsquo;t write from theory. The guidance here comes from hands-on work, so it tends to be detailed and specific rather than high-level. Where something is a caveat or a gotcha, I call it out.\nVerify and connect My up-to-date career path and certifications live on my LinkedIn profile — feel free to check them there, or reach out:\n👉 linkedin.com/in/gabor-szekeres\n","permalink":"https://gaborszekeres.com/about/","summary":"\u003ch2 id=\"hi-im-gabor\"\u003eHi, I\u0026rsquo;m Gabor\u003c/h2\u003e\n\u003cp\u003eI\u0026rsquo;ve worked in information security since \u003cstrong\u003eJanuary 2019\u003c/strong\u003e, always in hands-on\ntechnical roles. My day-to-day is spent in the details — configuring, testing,\nbreaking, and hardening real systems — and that\u0026rsquo;s exactly what I write about here.\u003c/p\u003e\n\u003ch2 id=\"what-i-write-about\"\u003eWhat I write about\u003c/h2\u003e\n\u003cp\u003eThis blog covers \u003cstrong\u003eMicrosoft cloud security\u003c/strong\u003e and \u003cstrong\u003eAI security\u003c/strong\u003e. Expect practical,\nreproducible write-ups on topics like:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMicrosoft Entra ID — identity protection, Conditional Access, privileged access\u003c/li\u003e\n\u003cli\u003eAzure and Microsoft 365 security\u003c/li\u003e\n\u003cli\u003eMicrosoft Purview and data security\u003c/li\u003e\n\u003cli\u003eThe emerging attack surface around AI systems\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eEvery post aims to be something a fellow practitioner can actually follow: concrete\nsteps, real commands and code, screenshots, and the caveats that only show up once\nyou\u0026rsquo;ve done it for real.\u003c/p\u003e","title":"About"}]