Privileged Identity Management (PIM): just-in-time admin, done right

The most dangerous thing in your tenant isn't an unpatched server — it's the ten people carrying Global Admin they use twice a year. PIM makes privilege something you switch on when you need it and lose when you don't.

New to cloud? CAMPUX is a free, build-first course. Start here →

The core of PIM is one move: make privileged roles eligible instead of permanently active, so admins hold ordinary rights until they activate a role — with MFA, a justification, an expiry, and approval for the highest roles. Add recurring access reviews to stop privilege creep, keep the number of Global Administrators tiny, extend PIM to Azure resource roles and groups, and keep monitored break-glass accounts outside it. Everything else is tuning; the risk reduction is in removing standing access.

Standing privilege is the quiet liability in most tenants. Every account that permanently holds an admin role is a full compromise waiting for one phished session — and the more of them there are, the wider the door. PIM (a Microsoft Entra ID P2 capability) flips the default from "you're an admin all the time" to "you can become an admin, briefly, when the work needs it and the system agrees." Here's how to run it well.

1. Eligible, not active — the whole point

PIM has two kinds of assignment, and the entire benefit lives in choosing the right one:

Make privileged roles eligible. An eligible admin spends the day as an ordinary user, so a stolen session usually can't touch anything privileged — the attacker would still have to activate the role, and that's where your controls sit.

2. Put real controls on activation

Activation is the gate. Configure each role's PIM settings so switching a role on isn't free:

• Require MFA on activation — always.
• Require a justification, so every elevation has a written reason in the log.
• Require approval for the highest-impact roles (Global Administrator, Privileged Role Administrator) — a second person signs off.
• Short activation window — a few hours, not a day; the role expires on its own.
• Tie a ticket number in the justification where you can, so elevations reconcile against real work.

Now a compromised account can't silently become admin: it has to pass MFA, state a reason, and sometimes wait for a human — and whatever it does is time-boxed and recorded.

3. Least privilege — and very few Global Admins

PIM makes privilege temporary; least privilege makes it small. Prefer a specific role (User Administrator, Exchange Administrator) over Global Administrator for day-to-day work, and keep the number of Global Admins deliberately tiny — Microsoft's guidance is roughly two to five. Every Global Admin is a top-value target, so the fewer eligible for it, the smaller the prize.

4. Run access reviews so privilege doesn't creep

Eligibility granted once tends to live forever. Access reviews fix that: schedule recurring reviews where a role owner confirms each person still needs their eligible assignment, and remove the ones no longer justified. Without reviews, your "small" set of eligible admins quietly grows every reorg until it isn't small anymore.

5. Cover Entra roles, Azure resources, and groups

PIM isn't only for directory roles. Use it for Azure resource roles (Owner/Contributor on subscriptions and resource groups) so infrastructure privilege is just-in-time too, and for PIM for Groups to make membership of a powerful group activatable. If a static RBAC role assignment grants standing Owner on a subscription, that's the same standing-privilege problem this whole article is about — make it eligible. (New to the RBAC roles themselves? See Owner vs Contributor vs Reader.)

6. Keep break-glass out of PIM — and watched

PIM is a dependency: if activation itself is unavailable, no one can elevate. So keep at least two emergency access (break-glass) accounts with standing access outside PIM and Conditional Access, protected by long offline passwords and — critically — alerted on every sign-in. They're the manual override for the day PIM can't help you, and the monitoring is what keeps that override safe.

Permanent admin is a standing invitation. PIM turns it into a request you can see, time, and refuse.

Questions people also ask

What is Privileged Identity Management in Microsoft Entra?

An Entra ID P2 feature giving just-in-time, time-bound access to privileged roles. Instead of holding an admin role permanently, a user is made eligible and activates it when needed, with controls like MFA, justification, approval and expiry. It covers Entra roles, Azure resource roles and PIM-managed groups.

What's the difference between eligible and active assignments?

Active means the user holds the role all the time (standing access). Eligible means they can activate it when needed, subject to your controls, and it expires. Make privileged roles eligible so no one carries admin rights they aren't currently using.

How does PIM reduce risk?

It removes standing privilege. Most of the day an eligible admin has ordinary rights, so a phished session usually can't do admin harm; activating requires MFA, a justification and sometimes approval, and the elevation is time-limited and logged.

How many Global Administrators should I have?

Few — Microsoft suggests about two to five. It's the most powerful role and every holder is a target. Make it eligible via PIM, require approval to activate, prefer specific roles for daily work, and keep break-glass accounts separate.

What are access reviews?

Recurring checks where owners confirm each person still needs their eligible privileged assignment, preventing privilege creep. Schedule them for every privileged role and remove eligibility reviewers no longer justify.