How to set up PIM for the Global Administrator role

Setting up PIM for Global Administrator means three things: tighten the role's activation settings (short duration, MFA, justification, optionally approval), convert every permanent Global Admin except the break-glass accounts to an eligible assignment, and turn on the alerts that tell you when someone bypasses the process. After that, nobody in the tenant holds standing Global Admin, and a stolen admin session is worth a few hours at most.

The operating model — who reviews activations, how to handle role sprawl, and how PIM for Groups fits — is in the PIM operational playbook; the product overview is Entra ID Privileged Identity Management. This page is the initial setup for the one role that matters most.

Prerequisites

• Entra ID P2 (E5, E5 Security, Entra Suite, or standalone) for every admin who will be eligible.
• Privileged Role Administrator or Global Administrator to configure PIM.
• Two break-glass accounts with permanent active Global Administrator, excluded from Conditional Access. Do not start converting admins to eligible without them.
• A list of everyone who currently holds Global Administrator, with a reason each. Entra → Roles and administrators → Global Administrator → Assignments — anything over five is a role design problem to address first; see Microsoft 365 admin role design.

Steps

1. Configure the role settings

Entra admin center → Identity governance → Privileged Identity Management → Microsoft Entra roles → Roles → Global Administrator → Settings → Edit.

Activation:

• Activation maximum duration: 4 hours (or 2).
• On activation, require: Microsoft Entra Conditional Access authentication context if you have an authentication context tied to a phishing-resistant MFA policy (recommended, see Entra ID authentication contexts); otherwise Azure MFA.
• Require justification: Yes. Require ticket information: Yes if you have a ticketing system that admins actually use.
• Require approval: your call per the FAQ. If yes, name at least two approvers.

Assignment:

• Allow permanent eligible assignment: No; set a maximum of 12 months so eligibility itself is reviewed.
• Allow permanent active assignment: No — with the break-glass accounts assigned before you flip this, since existing permanent assignments are not removed by the setting, only new ones prevented.
• Require MFA on active assignment: Yes.

Notifications: keep the defaults; make sure the "role activated" alerts go to a monitored mailbox, not one individual.

2. Convert permanent admins to eligible

PIM → Microsoft Entra roles → Assignments → Global Administrator. For each human admin (not break-glass): select the active assignment → Convert to eligible (or Remove and then Add assignments → Eligible). Set an assignment end date of 6–12 months.

Do yourself first and test activation before touching anyone else.

3. Give admins a lesser standing role

Most daily admin work does not need GA. Assign the roles people actually use — Exchange Administrator, Intune Administrator, User Administrator — as eligible too, so Global Admin activation becomes rare and visible. Where a role is used every day by the same person, an eligible assignment with a longer activation window is still better than permanent.

4. Enable and route PIM alerts

PIM → Microsoft Entra roles → Alerts. Make sure these are on and their settings are sane: Roles are being assigned outside of PIM, Roles are being activated too frequently, There are too many global administrators (threshold 5 or lower), Potential stale accounts in a privileged role. Route the alert emails to the security channel.

5. Schedule an access review

PIM → Microsoft Entra roles → Access reviews → New: Global Administrator, quarterly, reviewers = the admins' managers or a named Privileged Role Administrator, Auto apply results: Enable, If reviewers don't respond: Remove access. This is what stops the eligible list growing back. Background in Entra ID access reviews.

Verify

• As a converted admin, open PIM → My roles → Eligible assignments → Global Administrator → Activate: you should be prompted for MFA (or the auth context policy), a justification, and land with the role active for the configured duration. Confirm the audit entry under PIM → Audit history.
• Roles and administrators → Global Administrator shows only the break-glass accounts under Active assignments outside PIM.
• Trigger the assigned outside PIM alert deliberately by assigning a test role directly, then remove it — confirm the email arrived.

Roll back

Any Privileged Role Administrator (or a break-glass account) can Add assignments → Active → Permanently assigned to give someone standing GA back, or loosen the settings. If activation is failing for everyone at once — typically an authentication-context policy misconfigured, or MFA broken — that is the scenario the break-glass account exists for: sign in with it, set On activation, require back to None temporarily, and fix the underlying policy with the Conditional Access testing guide.