Do I need Entra ID P2 for Privileged Identity Management?
Yes. Privileged Identity Management — just-in-time, time-bound activation of privileged roles with approval workflows and access reviews — requires Entra ID P2 (or Microsoft 365 E5, which includes it). Entra ID P1 covers Conditional Access and other baseline features, but not PIM.
What PIM adds over standing role assignments
- Time-bound activation instead of permanent Global Administrator or other privileged role membership.
- Approval workflows and justification prompts at activation time.
- Access reviews that periodically re-certify who still needs a privileged role.
- Alerting on roles activated outside expected patterns.
Read next
- Entra ID Privileged Identity Management— PIM turns standing admin access into just-in-time, approval-gated activation. The model, what it covers, role settings that work, and a rollout that sticks.