Do I need both Conditional Access and PIM?
For any admin directory role, yes, use both. Conditional Access decides what happens at sign-in — MFA, device compliance, location, risk. PIM decides whether the privileged role exists to sign in with at all, by making it eligible and time-bound instead of a standing assignment. A tenant with only CA can still have an admin role assigned permanently; a tenant with only PIM can still let an activated admin session in with weak authentication.
What each one actually controls
- Conditional Access: conditions on the sign-in itself — who, what device, from where, at what risk level.
- PIM: whether a directory role is active right now, for how long, and under what justification or approval.
The baseline for admin roles
- Move standing admin role assignments to PIM-eligible, activated on demand with justification.
- Apply a Conditional Access policy scoped to admin roles requiring the strongest authentication available (ideally phishing-resistant MFA), with no location exceptions.
- Review PIM activation logs and access reviews on a fixed schedule — an eligible role nobody ever reviews drifts back toward standing access.
Read next
- Entra ID Conditional Access design— Designing a Conditional Access baseline: the policies, the principles, the order to write them in, and the habits that keep the estate healthy.
- Entra ID Privileged Identity Management— PIM turns standing admin access into just-in-time, approval-gated activation. The model, what it covers, role settings that work, and a rollout that sticks.
- Microsoft 365 admin role design— How to design admin role assignments for least-privilege Microsoft 365 administration at scale.