Skip to content
← Back to the guide

How to set up PIM for the Global Administrator role

8slides. Screenshot a slide, download it as a PNG, or use your browser's Print → Save as PDF for a LinkedIn-ready multi-page carousel — each slide becomes one page.

M
solvingmicrosoft365.com
1 / 8

How to set up PIM for the Global Administrator role

How to set up Privileged Identity Management for Global Administrator in Entra ID: role settings, convert permanent admins to eligible, approvals, and alerts.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-set-up-pim-for-global-administrator

Slide 1Download PNG
M
solvingmicrosoft365.com
2 / 8
01

What licence does PIM need?

Entra ID P2, which is included in Microsoft 365 E5, E5 Security, and the Entra Suite. Every user who is eligible for or activates a role through PIM needs a P2 licence; users who merely hold a permanent assignment do no…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-set-up-pim-for-global-administrator

Slide 2Download PNG
M
solvingmicrosoft365.com
3 / 8
02

How long should Global Administrator activation last?

As short as the work allows. Four hours is a common ceiling; many tenants use two. The role can be re-activated when it expires, so a short window costs the admin a minute and buys a much smaller blast radius for a stol…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-set-up-pim-for-global-administrator

Slide 3Download PNG
M
solvingmicrosoft365.com
4 / 8
03

Should I require approval for Global Administrator activation?

For a small team, approval creates a lockout risk (the approver is on holiday) and is often replaced by MFA plus justification plus alerting. For larger organisations, approval by a second Global Administrator or Privil…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-set-up-pim-for-global-administrator

Slide 4Download PNG
M
solvingmicrosoft365.com
5 / 8
04

Step 1: Configure the role settings

Entra admin center → Identity governance → Privileged Identity Management → Microsoft Entra roles → Roles → Global Administrator → Settings → Edit.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-set-up-pim-for-global-administrator

Slide 5Download PNG
M
solvingmicrosoft365.com
6 / 8
05

Step 2: Convert permanent admins to eligible

PIM → Microsoft Entra roles → Assignments → Global Administrator. For each human admin (not break-glass): select the active assignment → Convert to eligible (or Remove and then Add assignments → Eligible). Set an assign…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-set-up-pim-for-global-administrator

Slide 6Download PNG
M
solvingmicrosoft365.com
7 / 8
06

Step 3: Give admins a lesser standing role

Most daily admin work does not need GA. Assign the roles people actually use — Exchange Administrator, Intune Administrator, User Administrator — as eligible too, so Global Admin activation becomes rare and visible. Whe…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-set-up-pim-for-global-administrator

Slide 7Download PNG
M
solvingmicrosoft365.com
8 / 8
07

Step 4: Enable and route PIM alerts

PIM → Microsoft Entra roles → Alerts. Make sure these are on and their settings are sane: Roles are being assigned outside of PIM, Roles are being activated too frequently, There are too many global administrators (thre…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-set-up-pim-for-global-administrator

Slide 8Download PNG

Auto-generated from How to set up PIM for the Global Administrator role. This page is not indexed and isn't part of the guide itself.