Privileged Identity Management (PIM)

Privileged Identity Management (PIM) in Microsoft Entra turns permanent administrator access into just-in-time access: a person is made eligible for a role, and has to activate it (with MFA, a justification, possibly approval) for a limited time before using it. The decision rule for exams: if the requirement is “only when needed”, “time-limited”, “with approval” or “with an audit trail” for a privileged role, the answer is PIM. If it is about the conditions of a sign-in, it is Conditional Access.

The life of one PIM assignment

PIM is easiest to remember as a sequence. Each step maps to a setting that exam questions mention.

1. Assign. An administrator assigns a role to a user, group, service principal or managed identity. The assignment has a scope, a type and a duration. The type is the core idea:

Microsoft’s documentation points out that a permanent role and an eligible one give the same access once active. The difference is only that eligible people do not hold it all the time. Duration is separate from type: an assignment can be permanent or time-bound (with start and end dates), whether eligible or active.

2. Activate. The eligible user requests the role in PIM, choosing a duration up to the maximum and giving a reason. Depending on the role’s settings, activation can require MFA, a justification, ticket information (a free-text field, not validated against a ticketing system), approval, or a Conditional Access authentication context.

3. Approve. If approval is required, the designated approvers get an email and approve or deny. Approvers do not need any role themselves. If no approvers are chosen, active Privileged Role Administrators and Global Administrators are the default approvers.

4. Expire. After the activation period the role drops off by itself. For time-bound assignments, the user can request an extend or renew, which needs approval from a Global Administrator or Privileged Role Administrator.

5. Review and audit. Access reviews check whether people still need their eligibility, and the audit history can be downloaded. Notifications are sent when roles are activated.

Settings that live on the role

Role settings (also called the PIM policy) are defined per role, and all assignments of that role follow them. A few that exams mention:

• Activation maximum duration: a range of one to 24 hours in the Entra role settings.
• Require MFA on activation, require justification, require approval.
• Require a Conditional Access authentication context: ties PIM to Conditional Access, for example demanding a phishing-resistant authentication strength at activation.
• Maximum duration for eligible and active assignments, and whether permanent assignments are allowed.

Note one limit Microsoft states explicitly: PIM cannot enforce MFA when a user uses an active assignment, because the user is already active from the moment of assignment. MFA at activation only applies to eligible assignments.

What PIM covers

PIM manages three families of assignment: Microsoft Entra roles (Global Administrator and the rest), Azure resource roles (Azure RBAC roles at management group, subscription, resource group or resource scope), and PIM for Groups, which gives time-bound membership or ownership of groups. Licensing is required for PIM; check Microsoft’s current licensing page rather than relying on a number from a study guide.

Who manages what: for Entra roles, Privileged Role Administrators and Global Administrators manage assignments. For Azure resource roles, a subscription administrator, resource Owner or User Access Administrator does. A Privileged Role Administrator does not automatically see Azure resource role assignments.

Worked example

A company has four people who occasionally need Exchange Administrator for mailbox work. Today they hold it permanently. The security team wants it only during work, with a reason, and wants a manager’s approval for the Global Administrator role.

The design: make all four eligible for Exchange Administrator with a four-hour maximum activation, MFA and justification required, and no permanent assignment. Make two people eligible for Global Administrator with approval required, a one-hour maximum, and two named approvers. Keep two cloud-only emergency accounts active and permanent, excluded from approval flows, so the tenant cannot be locked out. Add a quarterly access review of the eligible assignments.

The emergency accounts matter because of a warning in Microsoft’s documentation: if all Global Administrators and Privileged Role Administrators are only eligible with none active, approval is required, and no approvers are configured, the tenant can be locked out.

Which exams test this

How questions are built around it

The scenario nearly always starts with “administrators currently have permanent access”. The distractors are tools that restrict something else:

• Conditional Access controls how a sign-in happens, not how long a role is held.
• Access reviews remove access that is no longer needed, but on a schedule, not at the moment of use.
• Azure RBAC assigns the role; PIM decides when it is active.
• Administrative units limit scope, not time.

Constraint words: “just-in-time”, “eligible”, “time-bound”, “approval before use”, “justification”, “temporary”. A requirement for “MFA every time an administrator uses a role” is activation MFA or an authentication context in PIM, not a general Conditional Access policy. And remember the other direction: a Conditional Access policy scoped to a directory role does not apply during activation, because the user does not hold the role yet. Microsoft therefore recommends an authentication context, with the policy scoped to all or eligible users, required on activation in PIM.

Practice questions

Go deeper

• What is Privileged Identity Management? (Microsoft Learn)
• Configure Microsoft Entra role settings in PIM (Microsoft Learn)
• Related on this site: Conditional Access explained, Azure RBAC vs Entra roles and how to study for certification exams.