What Is Azure AD Privileged Identity Management (PIM)? Microsoft Entra PIM Explained

What Is Azure AD Privileged Identity Management (PIM)? Microsoft Entra PIM Explained

Originally published 15 October 2020 · Reviewed 5 November 2026

Privileged Identity Management (PIM) in Microsoft Entra, formerly Azure AD Privileged Identity Management, reduces the time that powerful roles are exposed. Most compromises that matter involve an administrator account, and many organisations leave dozens of people permanently assigned as Global Administrator "just in case". PIM replaces that standing access with access that is requested, approved where needed, time-limited and logged.

Eligible and active

The core idea is the difference between two assignment types:

• Eligible. The person can activate the role but does not have its permissions until they do.
• Active. The person has the role's permissions now, either permanently or for a set period.

A user with an eligible assignment activates the role when needed, for a limited duration, and the permissions disappear when it expires. The default goal is that nobody is permanently active in a high-privilege role except emergency access accounts.

What can be controlled at activation

Role settings in PIM let you require, per role:

• multifactor authentication on activation, or a Conditional Access authentication context for stronger rules;
• a written justification, and optionally a support ticket reference;
• approval by one or more named approvers;
• a maximum activation duration;
• notifications to administrators when roles are activated.

This turns a quiet, permanent permission into a recorded event, which helps with both security and audit.

What PIM covers

PIM manages Microsoft Entra roles, such as Global Administrator and Exchange Administrator, and Azure resource roles at management group, subscription, resource group and resource scope. PIM for Groups extends the same just-in-time model to membership or ownership of groups that grant access. It keeps a history of assignments and activations and provides alerts, for example when too many people hold a privileged role.

Reviews and clean-up

Access reviews work with PIM to ask owners or managers periodically whether privileged assignments are still needed. Removing unused assignments is often the largest early win, because many privileged roles were granted for a project and never removed.

Licensing

Microsoft's licensing page states that PIM needs Microsoft Entra ID P2 or Microsoft Entra ID Governance licences for the following users: those with eligible or time-bound role assignments, those who approve or reject activation requests, and those assigned to or performing access reviews. If a licence expires, PIM features stop being available, eligible assignments of Microsoft Entra roles are removed because users can no longer activate them, and permanent assignments are unaffected. Plan renewals so that administrators do not lose their access path.

A rollout plan

1. Inventory privileged roles. List who holds Global Administrator and other high-privilege roles today, and why.
2. Create emergency access accounts. Two cloud-only accounts, protected by strong methods and monitored, that are excluded from PIM activation and from Conditional Access lockouts.
3. Separate daily and admin identities. Administrators should use a dedicated account for privileged work, not their email account.
4. Convert standing assignments to eligible, starting with the most powerful roles.
5. Set role settings. Require MFA and justification, add approval for the most sensitive roles, and choose short durations.
6. Turn on notifications and alerts, and send them to a mailbox that someone reads.
7. Schedule reviews of eligible assignments, quarterly for high-privilege roles.
8. Test activation with each role holder before removing the old assignments.

Common mistakes

• Making everyone eligible for everything. Eligibility is still privilege; keep it as narrow as the old assignments should have been.
• Approval with no one watching. An approver who never sees the request becomes a delay, not a control.
• Forgetting Azure resources. PIM for Azure roles is configured separately from Microsoft Entra roles.
• Over-long activation windows. If a role is active for a whole day, you have recreated standing access.
• No break-glass plan. If PIM, MFA or a licence fails, you still need a way into the tenant.

What PIM does not do

PIM controls when privilege is available. It does not stop an attacker who steals a session while a role is active, so combine it with phishing-resistant authentication, Conditional Access for admin roles, and monitoring of sign-ins and role changes.

Questions administrators ask

Does eligible mean slower work? Activation takes a minute or two for roles without approval, and the time cost is the point: it makes people think about whether they need the role. Most teams adapt quickly, especially if they bundle admin tasks into one activation.

Can scripts and automation use PIM? Interactive people activate roles. Automation should use workload identities with narrowly scoped permissions, not a human administrator's role, so review each automated task separately.

What happens to roles outside Microsoft Entra, such as Exchange or SharePoint? Microsoft Entra roles with those names are covered, but product-specific role groups inside other services have their own models, so check which controls apply where.

How do I prove it works? Export the activation history and the assignment list for the audit, and keep the evidence that standing Global Administrator assignments fell from many to a handful.

Where do I start if I only have an afternoon? List the permanent Global Administrators, remove the ones who do not need the role, and make the rest eligible.

Microsoft references

• What is Privileged Identity Management?, reviewed 5 November 2026.
• Microsoft Entra licensing, including the PIM licence section, reviewed 5 November 2026.

This article was first published on 15 October 2020. It was rewritten on 5 November 2026 with current product names and licensing. Microsoft's live documentation takes precedence if it has changed.