Initial draft of best practices

Author: rolyon

.openpublishing.redirection.json

@@ -33548,7 +33548,12 @@
     },
     {
       "source_path": "articles/active-directory/pim-azure-resource.md",
-      "redirect_url": "/azure/role-based-access-control/pim-azure-resource",
+      "redirect_url": "/azure/role-based-access-control/best-practices",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "articles/role-based-access-control/pim-azure-resource.md",
+      "redirect_url": "/azure/role-based-access-control/best-practices",
       "redirect_document_id": true
     },
     {

articles/role-based-access-control/TOC.yml

@@ -28,8 +28,8 @@
     href: tutorial-custom-role-cli.md
 - name: Concepts
   items:
-  - name: PIM for Azure resources
-    href: pim-azure-resource.md
+  - name: Best practices
+    href: best-practices.md
   - name: Conditional Access for Azure management
     href: conditional-access-azure-management.md
 - name: How-to guides

articles/role-based-access-control/best-practices.md

@@ -27,6 +27,20 @@ Using Azure RBAC, you can segregate duties within your team and grant only the a
 
 When planning your access control strategy, it's a best practice to grant users the least privilege to get their work done. The following diagram shows a suggested pattern for using RBAC.
 
-![RBAC and least privilege](./media/overview/rbac-least-privilege.png)
+![RBAC and least privilege](./media/best-practices/rbac-least-privilege.png)
+
+For information about how to add role assignments, see [Add or remove role assignments](role-assignments-portal.md).
+
+## Limit the number of subscription owners
+
+You should have a maximum of 3 subscription owners to reduce the potential for breach by a compromised owner. This recommendation can be monitored in Azure Security Center. For other identity and access recommendations, see [Security recommendations - a reference guide](../security-center/recommendations-reference.md).
+
+## Use Azure AD Privileged Identity Management
+
+To protect privileged accounts from malicious cyber-attacks, you can use Azure Active Directory Privileged Identity Management (PIM) to lower the exposure time of privileges and increase your visibility into their use through reports and alerts. PIM helps protect privileged accounts by providing just-in-time privileged access to Azure AD and Azure resources. Access can be time bound after which privileges are revoked automatically. 
+
+For more information, see [What is Azure AD Privileged Identity Management?](../active-directory/privileged-identity-management/pim-configure.md).
 
 ## Next steps
+
+- [Troubleshoot Azure RBAC](troubleshooting.md)