Microsoft Entra ID PIM: Complete Privileged Identity Management Setup Guide

What is Microsoft Entra ID PIM?

Microsoft Entra ID Privileged Identity Management (PIM) is a just-in-time access service. Instead of admins holding privileged roles permanently, PIM makes them eligible for a role and requires an activation request, typically gated by multifactor authentication and approval, before the role becomes usable for a limited time window. It is the primary Microsoft Entra control for eliminating standing privileged access.

The problem PIM solves

Standing privileges are a top attack vector. When a Global Administrator account is always active 24/7, it is always at risk. If the account is phished or the device is compromised, the attacker immediately has Global Admin access.

PIM breaks that chain by converting standing access into time-bound, audited access instead. An attacker who compromises a PIM-protected account gets no privileged access by default. They would need to trigger an activation request that requires MFA, manager approval, and leaves a full audit trail, none of which a stolen password alone can satisfy.

For a complete picture of Microsoft Entra identity governance, pair PIM with Conditional Access policies, which control where and how activation requests are allowed, for example blocking activation from non-compliant devices or risky sign-in locations.

Prerequisites and licensing

• License: Microsoft Entra ID P2, included in Microsoft 365 E5 and the Microsoft 365 E5 Security add-on, or available as a standalone Entra ID P2 license. Entra ID P1 (included in Microsoft 365 E3) does not include PIM.

You do not need P2 for every user in the tenant, only for users who are eligible for or actively assigned a PIM-managed role. Microsoft Entra ID Governance and the broader Microsoft Entra Suite also include PIM, bundled with entitlement management and access reviews, which is worth checking before buying Entra ID P2 standalone if you are already consolidating on one of those governance SKUs.

What PIM covers

PIM for groups: one activation, multiple resources

PIM for Groups lets you grant a role-assignable group permanent access to several Entra ID roles or Azure roles at once, then make individual users eligible members or owners of that group instead of assigning each role directly. One activation request then grants access to every resource linked to the group, which matters for admins who would otherwise need five or six separate activations just to start their workday. Microsoft specifically recommends this pattern for users who accumulate many eligible role assignments over time, to reduce activation friction without reintroducing standing access.

Setting up PIM: step-by-step

Step 1: Navigate to PIM

Microsoft Entra admin center (entra.microsoft.com) -> Identity Governance -> Privileged Identity Management

Step 2: Configure role settings

For Global Administrator:

PIM -> Entra ID Roles -> Settings -> Global Administrator -> Edit

Activation:
  Duration: 4 hours
  Require Azure MFA: Yes
  Require justification: Yes
  Require approval: Yes (at least 2 approvers)

Assignment:
  Allow permanent eligible: No (max 12 months)
  Allow permanent active: No (break-glass accounts only)

Notifications:
  Notify when role is activated: Yes
  Notify approvers when pending: Yes

Require MFA on activation for every privileged role without exception. Microsoft’s own analysis of Entra ID accounts found that using multifactor authentication makes an account 99.9% less likely to be compromised than one without it.

The activation maximum duration slider accepts any value from 1 to 24 hours; there is no way to set a shorter or longer window at the platform level. Before you require approval for every activation, configure emergency access accounts and name specific approvers. If every Global Administrator and Privileged Role Administrator is eligible-only, approval is required, and no approvers are configured, nobody, including the people trying to fix the settings, can activate anything.

Step 3: Convert permanent assignments to eligible

Microsoft’s own best-practice guidance recommends keeping Global Administrator assignments to fewer than five people, and keeping total privileged role assignments (roles capable of modifying credentials or elevating access) to fewer than ten across the tenant. The Entra admin center surfaces a warning directly on the Roles and administrators page when either threshold is exceeded.

For each current permanent admin:

1. Remove their permanent (active) assignment.
2. Add them as eligible for the same role with a 12-month expiration.

Keep one or two emergency-access ("break-glass") accounts with permanent Global Administrator assignments, protected with hardware FIDO2 keys and offline-stored credentials, excluded from policies that could accidentally lock them out, and alerted on every sign-in. See our break-glass account setup guide for the full configuration.

Step 4: The activation experience

When an admin needs elevated access:

1. Go to PIM -> My roles -> click Activate.
2. Enter justification (for example, "Configuring user onboarding automation - INC-4521").
3. Complete the MFA challenge.
4. Wait for approval (typically 5-15 minutes).
5. Role expires automatically after the configured duration.

Step 5: Assign Azure resource roles

PIM for Azure resources works differently from PIM for Entra ID roles: you configure it per management group, subscription, resource group, or resource instead of tenant-wide, and only Owner, User Access Administrator, or a Global Administrator with subscription management enabled can manage it. Go to PIM -> Azure resources, pick the scope, and add an eligible or active assignment the same way as an Entra ID role.

One hard constraint worth planning around: an Azure resource role assignment cannot be shorter than five minutes and cannot be removed within five minutes of being created, so a temporary break-fix assignment needs at least that much lead time. For automated onboarding, the same assignment can be created through the Azure Resource Manager API’s roleEligibilityScheduleRequests endpoint instead of the portal, which is the more practical path if PIM assignment is part of a larger infrastructure-as-code pipeline.

Access reviews: keeping assignments clean

PIM -> Access Reviews -> New access review

  Name: Quarterly Global Admin PIM Review
  Scope: Global Administrator role members
  Reviewers: Managers of eligible members
  Duration: 14 days
  Recurrence: Quarterly
  Auto-apply: Yes (no response = remove access)

Managers receive quarterly emails to confirm their reports still need eligibility. No response means automatic removal. Scope reviews by tier: tier-0 roles (Global Administrator, Privileged Role Administrator, Security Administrator) justify a quarterly cadence, while lower-tier admin roles can run semi-annually without meaningfully increasing risk.

Key alerts to monitor

Route PIM audit logs to Sentinel. Build detection rules for activations outside business hours, unusual justification text, and repeated failed activation attempts.

Strengthening with Conditional Access

Require a compliant device for all PIM activations:

Conditional Access policy:
  Users: Admins eligible for tier-0 roles
  Cloud apps: Microsoft Azure Management
  Grant: Require compliant device AND MFA

Three independent barriers now stand between an attacker and a privileged role: a compliant device, MFA, and a PIM activation request that needs approval.

PIM role settings also support requiring a Conditional Access authentication context on activation, instead of or in addition to plain MFA. This forces reauthentication with a specific method, for example phishing-resistant passwordless sign-in, at the moment of activation, even if the user already has an active session. As a safety net, if an authentication context is configured in PIM but no Conditional Access policy actually targets it, Entra ID falls back to requiring standard MFA rather than silently granting activation. That fallback only protects against a misconfiguration though, not against a policy that was created but left disabled or in report-only mode, so confirm the policy is enforced, not just present.

PIM vs standing privileged access: the tradeoff

PIM is not free. Activation adds a delay measured in minutes, approval workflows require someone to be reachable, and every eligible or active PIM user still needs an Entra ID P2 license whether they activate once a year or ten times a day. Weigh the tradeoff by role tier instead of applying PIM uniformly across the tenant.

In practice: keep standing access only for the emergency accounts described above and for workloads that cannot complete an interactive MFA challenge. PIM does not cover service principals or on-premises Active Directory group membership, even for groups synced into Entra ID, so those still need their own controls. Put every human admin performing Entra ID or Azure RBAC tasks through a PIM eligible assignment instead.

Common mistakes

• Activation too short: 1-hour windows frustrate admins on long tasks. 4-8 hours is usually right.
• Insufficient approvers: configure 2-3 approvers per critical role. One unavailable approver blocks emergency work.
• Notification fatigue: sending every PIM email to a full distribution list trains admins to ignore them. Route activation and access-review alerts to a monitored Teams channel or security mailbox, and reserve broad distribution for the alerts in the table above.
• No access reviews: without quarterly cleanup, eligible assignments accumulate indefinitely as people change teams or leave.
• Permanent eligible assignments: setting "Allow permanent eligible" to Yes defeats much of the point of PIM. An eligible assignment with no expiration just moves the standing risk from "active role" to "account that can request the role at will, forever." Cap eligible assignments at 12 months and force renewal through an access review.
• Approval lockout: if every Privileged Role Administrator and Global Administrator is eligible-only, approval is required, and no specific approvers are named, nobody can activate anything, including the role needed to fix the approval settings. Always name specific approvers and keep break-glass accounts active, not eligible.
• Assuming PIM covers everything: PIM protects Entra ID roles, Azure resource roles, and PIM-managed groups. It does not extend to service principals, on-premises Active Directory group membership, or most SaaS application-native admin roles. Audit those separately.

Measuring PIM effectiveness

Track monthly:

• Eligible vs. active assignment ratio (target: over 90% eligible for tier-0 roles).
• PIM activation rate (a persistently low rate may indicate unneeded eligible assignments).
• Access review completion rate (target: over 95% reviewed).

PIM is one of the highest-ROI identity security controls available. If you have Entra ID P2 and are not using PIM for tier-0 roles today, this is the place to start.

PIM setup and the eligible-versus-active distinction also show up directly on Microsoft’s SC-300 and AZ-500 exams. If you are prepping for either, treat the activation settings and role-tier decisions above as core exam material rather than background reading; see our AZ-500 vs SC-200 vs SC-300 comparison if you are still deciding which certification to pursue.

References

• Microsoft Entra PIM documentation: official PIM configuration and setup guide.
• Entra ID P2 licensing: PIM licensing requirements and tier comparison.
• Entra PIM access reviews: access review configuration and scheduling.
• Best practices for Microsoft Entra roles: source for the fewer-than-5-Global-Admins and fewer-than-10-privileged-assignments guidance, and the layered-controls model.
• Configure Microsoft Entra role settings in PIM: activation duration limits, authentication context, and the approval lockout scenario.
• Assign Azure resource roles in PIM: Azure resource role scoping and the 5-minute assignment duration limit.
• PIM for Groups: concept and configuration guide for role-assignable groups.
• NIST 800-53 AC-6: Least Privilege: regulatory basis for least-privilege access control.

Frequently asked questions

What is Microsoft Entra ID PIM?

Microsoft Entra ID Privileged Identity Management (PIM) is a service that enables just-in-time (JIT) access to privileged roles. Instead of having permanent role assignments (for example, a user always having Global Administrator), PIM makes users eligible for roles. When they need to perform an administrative task, they activate the role for a defined time window, optionally with manager approval and MFA verification. The role expires automatically, eliminating standing privileges that attackers can exploit.

What license do I need for Microsoft Entra ID PIM?

PIM requires Microsoft Entra ID P2 licensing, which is included in Microsoft 365 E5 and the Microsoft 365 E5 Security add-on. It is also available as a standalone Entra ID P2 license. Every user who is eligible for or manages a PIM-controlled role must have an Entra ID P2 license assigned. Entra ID P1 (included in M365 E3) does not include PIM.

What is the difference between eligible and active role assignments in PIM?

An eligible assignment means the user can request to activate the role when needed but does not have the role permissions continuously. An active assignment means the user has the role permissions at all times without needing to activate. PIM’s core value is converting standing active assignments to eligible assignments, so privileged access is time-limited and audited rather than permanently available.

How does PIM activation work for users?

A user with an eligible role assignment goes to the Entra ID PIM portal (or myaccess.microsoft.com), selects the role they want to activate, provides a business justification, and submits the request. Depending on the role configuration, activation may require MFA verification, manager approval, or both. Once approved, the role is active for the configured duration (typically 1-8 hours), after which it expires automatically and the user must reactivate if they still need access.

What is a PIM access review and how often should I run them?

A PIM access review is a periodic audit of role assignments asking designated reviewers (typically managers or role owners) to confirm whether each user still needs their eligible or active assignment. Microsoft recommends quarterly access reviews for tier-0 roles (Global Administrator, Privileged Role Administrator, Security Administrator) and semi-annual reviews for tier-1 roles. Without access reviews, eligible assignments accumulate indefinitely as team members change roles, leave the organization, or no longer need privileged access.

Does Microsoft Entra ID PIM cover service accounts or on-premises Active Directory?

No. PIM manages Entra ID directory roles, Azure resource roles (Azure RBAC), and PIM-managed groups. It does not manage service principal or application permissions, and it does not manage on-premises Active Directory group or role membership, even for groups synced into Entra ID through Entra Connect. Service principal privilege needs workload identity federation and credential controls, and on-premises AD needs its own tiered administration model.