Entra ID Privileged Identity Management

Privileged Identity Management (PIM) is the Entra ID feature that turns standing admin role assignments into just-in-time, time-bound activations. Instead of being a Global Administrator around the clock, an admin is eligible for the role: they request activation when they need it, prove who they are, hold the role for a few hours, and lose it again automatically. It's one of the highest-value-per-effort security controls in the entire Microsoft stack.

Why standing access is the problem

A permanent Global Admin assignment is a permanent attack surface. Phish that account — or its refresh token, or the machine it's signed in on — and the attacker is a Global Admin, at 3 a.m., for as long as they stay undetected. Standing access also decays socially: roles granted for one project outlive the project, and two years later nobody remembers why the intern's old account is an Exchange Administrator.

With PIM in place:

• Roles are eligible, not active. A compromised account holds only the user's day-to-day access.
• Activation demands fresh proof — MFA at activation time, or, better, a Conditional Access authentication context requiring a phishing-resistant method or a compliant workstation.
• Activations are time-boxed (commonly 1–8 hours) and can require justification, a ticket number, or explicit approval by another human.
• Every activation lands in the audit log and can raise an alert — "Global Admin activated outside business hours" is exactly the kind of signal a SOC wants.

The attacker's job changes from "use the access you stole" to "successfully impersonate the victim through an MFA-gated, logged, possibly approval-gated ceremony." That's a much worse job.

What PIM covers

• Entra ID roles — Global Administrator, User Administrator, Exchange Administrator, and the rest of the directory role catalogue. This is the core use case for Microsoft 365 tenants, and how the workload admin roles (Exchange, SharePoint, Teams, Intune) should be handed out — see Microsoft 365 admin role design.
• Azure resource roles — Owner, Contributor, and friends, scoped to management groups, subscriptions, or resources.
• PIM for Groups — eligibility for membership or ownership of a group. Powerful for two reasons: role-assignable groups let one activation grant a bundle of roles, and group-based licensing or app access can be made just-in-time the same way.

The three assignment states

• Eligible — can activate, holds nothing right now.
• Active — holds the role now, via activation or direct assignment.
• Permanent vs time-bound — both eligible and active assignments can carry expiry dates, so even eligibility can be forced through periodic renewal.

The operating rule: almost everything becomes Eligible. The exceptions are your break-glass accounts — permanent, active, excluded from Conditional Access, locked in a safe — and genuine service scenarios that can't perform an interactive activation.

Role settings that work in practice

Per role, PIM lets you tune activation duration, MFA/authentication context, justification, ticketing, and approval. A calibration that holds up:

• Global Administrator, Privileged Role Administrator, Security Administrator: 2–4 hour activation, approval required, justification required, phishing-resistant MFA via authentication context. Keep the eligible list brutally short — Microsoft's guidance of fewer than five Global Admins is right.
• Workload admins (Exchange, SharePoint, Teams, Intune): 8 hours, MFA and justification, no approval — these are daily-driver roles, and an approval gate on daily work teaches people to hate PIM.
• Read-heavy roles (Global Reader, Security Reader): consider these for standing assignment or long activations; friction here buys little.

That last point generalises: PIM fails through overreach. If activating a role people need ten times a day requires an approver who's asleep, admins will lobby for standing access again and they'll have a case. Reserve the heavy ceremony for the roles that can destroy the tenant.

Access reviews close the loop

PIM pairs with access reviews: recurring campaigns (quarterly is typical) that make role owners re-confirm every eligible and active assignment, with auto-removal for non-response. Activation history makes the review honest — an eligibility that hasn't been activated in six months is a strong candidate for removal. This is what catches the slow drift that created the standing-access mess in the first place.

Licensing

PIM requires Entra ID P2, which comes with Microsoft 365 E5, the E5 Security add-on, or Entra ID Governance SKUs. You don't need P2 for every user — you need it for users who benefit from PIM, i.e. the admin population. For an E3 tenant, licensing a couple of dozen admins for a step-up SKU is one of the cheapest meaningful security upgrades available.

Rollout

1. Inventory current role assignments (the PIM discovery view does this) and be prepared for unpleasant surprises.
2. Confirm break-glass accounts work, then convert standing assignments to Eligible, starting with the most privileged roles.
3. Configure per-role settings along the lines above.
4. Wire activation alerts into whatever your SOC watches.
5. Schedule quarterly access reviews per privileged role.
6. Extend to Azure resource roles and PIM for Groups once directory roles are stable.

The whole thing is a few weeks of part-time work for a typical tenant, and it converts your worst-case phishing outcome from "tenant compromise" to "one user's mailbox." Few controls trade effort for risk that well.