Conditional Access or PIM?

A short decision tool for a question that comes up constantly: should this control be a Conditional Access policy, a Privileged Identity Management role, or both. Client-side, no sign-up.

Short answer, most of the time: it isn’t either/or. Conditional Access gates the sign-in itself; PIM time-bounds whether a privileged role exists to sign in with at all. Admin roles almost always need both.

What are you trying to control?

A condition that should apply to every sign-in, regardless of role (MFA, device compliance, location, risk)Who holds an admin directory roleand when it’s usableA one-off or occasional task that needs elevated access for a short window

Reach for

Conditional Access

You're describing a control that should apply to a sign-in regardless of who it is or what role they hold — that's the condition-and-grant model Conditional Access is built for. PIM has nothing to say about a general user's everyday sign-in.

If the same population includes admins, give them a separate, stricter CA policy (phishing-resistant MFA, no location exceptions) in addition to whatever PIM does for their role activations.

Read the full baseline in Entra ID Conditional Access design and admin role design.