Microsoft Entra Privileged Identity Management (PIM) removes standing admin rights by making a role eligible instead of permanently active; the admin then activates it just-in-time, for a time-boxed window, subject to MFA, justification and optional approval. Setting it up means assigning eligible roles under ID Governance, then configuring each role's activation settings. PIM requires Microsoft Entra ID P2 (or an equivalent bundle such as Entra ID Governance).
Why PIM, and what it costs
A compromised admin account is a worst-case event. The traditional model of permanent Global Administrator access gives an attacker a standing target. PIM implements just-in-time (JIT) access: users hold roles in an Eligible state and activate them only when needed, which drastically shrinks the window of exposure. Every activation is logged — which is why PIM underpins the privileged-access controls behind SOC 2 and ISO 27001.
Licensing: PIM is a Microsoft Entra ID P2 capability (also available via Entra ID Governance). The requirement scales with your privileged population, not the whole tenant — every user who holds an eligible assignment, approves activations, or is reviewed in an access review needs a P2 or Governance licence, but ordinary users do not. Confirm the current SKU on Microsoft Learn before you rely on it, as Microsoft has repackaged identity bundles more than once.
Prerequisites
- Microsoft Entra ID P2 (or Entra ID Governance) licences for users who will hold eligible roles, act as approvers, or be reviewed.
- You must sign in as a Privileged Role Administrator or Global Administrator to manage assignments for others. Security Administrator, Global Reader and Security Reader can view PIM but not manage it.
- Two cloud-only break-glass / emergency access accounts, excluded from Conditional Access blocking policies and stored offline. Set these up before you lock down standing access — see our Conditional Access gaps guide for the exclusion pattern.
Step 1 — Open PIM
Sign in to the Microsoft Entra admin center as a Privileged Role Administrator or Global Administrator. Browse to ID Governance > Privileged Identity Management. (Microsoft Learn documents this path as Identity Governance › Privileged Identity Management; the portal label currently reads "ID Governance." Portal menu labels shift — if the tile is not visible, search "Privileged Identity Management" in the top bar.)
Step 2 — Assign an eligible role
- In PIM, select Microsoft Entra roles > Roles (or Assignments).
- Choose the role — start with something scoped, e.g. Exchange Administrator, not Global Administrator.
- Add assignments, select the user, and set assignment type to Eligible.
- Set a start/end date. Microsoft's recommended pattern is a 12-month maximum expiration on eligible assignments, paired with Access Reviews to catch unused access.
Gotcha: eligibility does not grant the role. The user must still activate it. If someone says "you gave me the role but I can't do anything," they have not activated.
Step 3 — Configure activation settings (role settings)
For each role, open Settings and configure:
- Maximum activation duration: a common hardening target is around 4 hours rather than the 8-hour default, to limit standing-active time. Activation duration is configurable in the 1–8 hour range.
- Require MFA on activation — on.
- Require justification — on.
- Require approval — for high-impact roles (Global Administrator, Privileged Role Administrator), require approval from a designated approver. Activation and renewal of Entra roles require approval from a Global Administrator or Privileged Role Administrator where configured.
- Require ticket number — optional, useful for audit trails.
Step 4 — Activate a role (the end-user experience)
The eligible user activates via Microsoft Entra admin center > ID Governance > Privileged Identity Management > My roles, selects the role, chooses Activate, completes MFA, and enters justification (and ticket/approval if required). PIM adds the active assignment within seconds; on expiry it removes it within seconds. Activation is also available in the Azure mobile app (iOS/Android) via the PIM card → My Microsoft Entra roles.
Step 5 — Validate before you enforce
Run an explicit test: confirm an eligible user can activate, that MFA and approval fire, and that the role deactivates on expiry. Only then remove standing assignments. Export PIM audit logs and, where you have Microsoft Sentinel, ingest them. Scripting the audit is straightforward with the Graph SDK — see PowerShell for Microsoft 365 administration for the connect-and-query pattern.
Step 6 — Add Access Reviews (the part most skip)
PIM alone leaves eligible assignments in place indefinitely. Access Reviews (an Entra ID Governance feature) automate periodic recertification — for example, "revoke eligible assignments from users with no activation history in the past N months." Microsoft's recommended pattern is a 12-month expiration on every eligible assignment plus an Access Review before expiry.
What breaks in production
- Locking down standing access before break-glass accounts exist is how you lock yourself out. Create and test two excluded emergency accounts first.
- Approval bottlenecks cause outages at 2 a.m. If the only approver is asleep, an on-call engineer cannot activate. Configure multiple approvers or an approver group.
- Licensing surprises: assigning an eligible role to a user without a P2/Governance licence is not a supported state. Confirm licence coverage before rollout.
- PIM for Groups vs roles confusion: you can make membership or ownership of a group eligible too, which is often cleaner for Azure resource roles — but it is a separate configuration surface.
Frequently asked questions
What licence do I need for Entra PIM?
Microsoft Entra ID P2, or a bundle that includes it such as Entra ID Governance. The requirement scales with your privileged population rather than the whole tenant — users who hold eligible assignments, approve activations, or are reviewed in access reviews each need a licence, but ordinary users do not. Verify the current SKU on Microsoft Learn, as Microsoft repackages identity licensing periodically.
What is the difference between eligible and active in PIM?
Eligible means the user holds the role but must activate it before it does anything; active means the role is currently in effect. PIM's model keeps roles eligible and activates them just-in-time, for a time-boxed window, so admins do not carry standing privilege between tasks.
How long can a PIM activation last?
Activation duration is configurable, typically between 1 and 8 hours per role. Many organisations shorten high-privilege roles to around 4 hours to limit the amount of time a role is standing-active, down from the 8-hour default.
Does PIM require MFA?
MFA on activation is a configurable requirement per role and is strongly recommended; it is one of the core activation controls Microsoft documents, alongside justification and optional approval. Enforcing MFA at activation means a stolen session cannot silently elevate to a privileged role.
Can I approve my own PIM activation?
For roles configured to require approval, activation needs a designated approver — a Global Administrator or Privileged Role Administrator, or a nominated group. You cannot self-approve a role that mandates approval, which is what makes approval a meaningful control for high-impact roles like Global Administrator.
Does PIM replace Conditional Access?
No — they are complementary. Conditional Access governs the conditions under which any sign-in is allowed (device, location, risk, MFA), while PIM governs whether and when a user can hold a privileged role at all. A hardened tenant uses both: Conditional Access to require phishing-resistant MFA for admins, and PIM to ensure those admin roles are eligible and time-boxed rather than standing. See the Conditional Access gaps guide for the policy side.