Entra PIM: replacing standing admin roles with just-in-time activation
In most tenants we audit, administrators hold their roles permanently, around the clock, whether they need them or not. Privileged Identity Management (PIM) makes those privileges available only when they are actually used. It still has to be configured properly to deliver that benefit.
The problem with standing roles
An account that permanently holds the Global Administrator role is a prime target: a single stolen token or hijacked session is enough to take over the whole tenant. The more privileged accounts are active at any given moment, the larger the attack surface. PIM has a simple goal: bring the number of active privileges close to zero at any point in time, without stopping teams from doing their jobs.
PIM is part of Microsoft Entra ID P2 (or Entra ID Governance). Every user who benefits from PIM needs the appropriate licence; check the current terms for your agreement.
Eligible versus active
PIM distinguishes two types of assignment:
- Eligible: the user can activate the role when needed but does not hold it by default;
- Active: the user holds the role continuously, with no action required.
Both can be permanent or time-bound. A sensible target is eligible assignments for every human administrator, with active assignments reserved for emergency access accounts and a handful of properly justified service identities.
Activation settings that matter
Each role has its own settings, and the defaults are rarely right for the most sensitive ones. Review these role by role:
- Maximum activation duration: a few hours covers most tasks; there is no reason to keep the maximum value.
- Authentication on activation: require MFA or, better, an authentication context linked to a Conditional Access policy that enforces a phishing-resistant method.
- Justification and, where relevant, a ticket number: invaluable for later investigation.
- Approval: keep it for critical roles (Global Administrator, Privileged Role Administrator, Privileged Authentication Administrator), with at least two available approvers.
- Notifications: alert the security team whenever the highest roles are activated.
Emergency accounts. Your two break-glass accounts should keep a permanent active assignment, be exempt from approval requirements and be closely monitored. A misconfigured PIM that locks out every administrator is a genuine operational risk.
Alerts and access reviews
PIM ships with built-in alerts: roles assigned outside PIM, too many Global Administrators, eligible users who never activate their role, activations that do not require MFA. They should be reviewed routinely rather than discovered during an incident. Access reviews let a manager or role owner periodically confirm that each assignment is still justified.
PIM for Groups
PIM is not limited to directory roles. With PIM for Groups, membership or ownership of a group can itself become eligible. This is useful for groups that carry role assignments, Azure permissions or access to sensitive applications. Be careful, though: if the group owners are not controlled themselves, they can bypass the whole mechanism by changing membership directly.
What an audit checks
- The number of permanent active assignments to privileged roles, excluding emergency accounts.
- Activation settings for critical roles: duration, MFA or authentication context, approval.
- Assignments made outside PIM, directly in the directory.
- Regular access reviews covering privileged roles and groups.
- Control over the owners of PIM-managed groups.