PIM

Privileged Identity Management (PIM) is the Microsoft Entra ID feature that turns standing admin role assignments into just-in-time, time-bound activations. Instead of being a Global Administrator 24/7, an eligible admin requests activation when needed, with MFA, justification, and (optionally) approval; the role expires automatically. Covers Entra ID roles, Azure resource roles, and groups. Access reviews enforce periodic recertification of eligibility. Requires Entra ID P2 licensing (included with Microsoft 365 E5). The single most important control for reducing the impact of compromised admin credentials.

Eligible vs active

PIM introduces a distinction that doesn't exist in plain Entra ID role assignment: a principal can be made eligible for a role (no standing permissions, but able to activate) rather than active in it (permissions apply right now). Eligible assignments can also carry a start and end date, so a contractor's eligibility for a support role can be scoped to the length of the engagement without anyone remembering to revoke it manually. Activation itself can require re-authentication (MFA), a business justification typed into a free-text box, a maximum activation duration (commonly capped well below the Entra ID default of 8 hours), and — for the highest-impact roles — approval by a designated approver before the activation takes effect.

Worked example

A tenant with 40 admins historically had 12 people standing in Global Administrator "just in case." Moving to PIM: those 12 become eligible for Global Administrator, not active. Day to day, none of them carries the role. When someone needs to do a genuinely tenant-wide action — say, configuring a cross-tenant trust setting — they open the My Roles view in the Entra admin center, activate Global Administrator with a justification ("configuring CTAS for the Contoso merger, ticket #4821"), complete an MFA challenge, and the role becomes active for the requested window, typically one to four hours, then automatically deactivates. The activation, the justification, and the deactivation are all logged and reviewable. If an attacker later phishes one of those 12 accounts outside of an active PIM session, the stolen credential does not carry Global Administrator rights — it has to also survive an MFA challenge and leave an audit trail to activate it.

PIM for groups

PIM isn't limited to Entra ID directory roles. PIM for Groups applies the same eligible/active/time-bound model to membership or ownership of any Entra ID security group — including groups used to grant Azure resource roles, application roles, or SharePoint site access. This is the mechanism that extends just-in-time access beyond the fixed catalog of built-in Entra ID roles to whatever custom access model a tenant has built around group membership.

Operational notes

Access reviews are what keep an eligible-assignment list honest over time — without them, "eligible for Global Administrator" quietly becomes as stale and over-provisioned as the standing assignments PIM was meant to replace, just one click further away. A recurring quarterly access review, with the resource owner (not IT) attesting that each assignment is still needed, is the standard pattern. The most common rollout mistake is applying strict activation requirements (approval, short duration) to every role uniformly, which drives admins to find workarounds; scoping approval requirements to genuinely high-impact roles (Global Administrator, Privileged Role Administrator, Application Administrator) while leaving lower-risk roles (Helpdesk Administrator) to self-activate with MFA keeps the control sustainable.