Key takeaways

  • Privileged Identity Management, or PIM, is the Microsoft Entra service that makes admin roles eligible instead of always active. People activate a role for a limited time, with MFA, a reason and optionally an approval.
  • Microsoft Learn says PIM requires licenses and points to its Entra ID Governance licensing page. Check what your tenant holds before you plan the rollout.
  • The Activation maximum duration setting runs from one to 24 hours. Short windows, such as one or two hours for the most powerful roles, reduce what an attacker can do with a stolen session.
  • Approval is optional per role. Microsoft recommends at least two approvers, and warns that if every approver is unable to act, you can be locked out.
  • Microsoft recommends two or more cloud-only emergency access accounts, using passkeys or certificates different from normal admins, excluded from Conditional Access policies that block sign-in, with sign-in alerts and a regular test.
  • Keep zero permanently active role assignments except the emergency accounts, as the PIM deployment guide recommends.

The problem PIM solves

In a typical small tenant, an owner and an IT contact hold Global Administrator all day, every day. They read email and browse the web with those same accounts. If one of them is phished, the attacker gets full control of the tenant at once. PIM does not remove the need for admins. It changes when the powers exist: only while someone is doing admin work.

The words you need

  • Eligible: the person can activate the role but does not have it right now.
  • Active: the person has the role without extra steps. Microsoft Learn notes there is no difference in the access of a permanent or an eligible assignment once active. The difference is when it exists.
  • Activate: the steps to use an eligible role, which can include MFA, a written reason, a ticket number and approval.
  • Activation duration: how long the role stays on before it expires.

Licensing, in general terms

Microsoft Learn states that using PIM requires licenses and refers readers to its Entra ID Governance licensing fundamentals page. Licensing names and bundles change, so read that page for your own tenant and ask your reseller which plan covers the users who will hold eligible roles. Do not assume Microsoft 365 plans include it.

A starting design for 5 to 100 users

  • Give each admin two accounts: a daily account with no admin roles and a named admin account that holds eligible roles only.
  • Make roles eligible, not active. Start with Global Administrator, Exchange Administrator, SharePoint Administrator, User Administrator and any role that reads mail or resets passwords.
  • Require MFA on activation for every role, plus a justification. Add a ticket number for high-impact roles.
  • Set the activation maximum duration as short as the work allows. The deployment guide's example uses one hour for Global Administrator and two hours for an Exchange role, and eight hours for a help desk role.
  • Use approval for Global Administrator and Privileged Role Administrator, with at least two approvers. In a tiny company the second approver can be an owner who is not an admin.
  • Turn on notifications so that every activation of Global Administrator emails the owners.
  • Schedule an access review of role assignments, so unused eligibility is removed.

Approval: useful, with a safety catch

Microsoft Learn says an approver does not need to hold a role, and recommends selecting at least two approvers. If no approver is selected, active Privileged Role Administrators and Global Administrators become default approvers. The same documentation warns that if none of them is active, nobody can approve and tenant administration is effectively locked. That is the reason the emergency accounts exist, and the reason to choose approvers who are not the same two people who need the approval.

Break-glass accounts

Emergency access accounts are for the day normal admin sign-in fails: a Conditional Access mistake, an MFA outage, a federation problem or a locked-out admin team. Microsoft Learn recommends:

  • Two or more accounts, cloud-only, on the onmicrosoft.com domain, not federated or synced from on premises.
  • Permanently assigned the Global Administrator role. They are the one exception to "no standing roles".
  • Phishing-resistant sign-in, a passkey (FIDO2) or certificate-based authentication, and different from the method your normal admins use.
  • Credentials that never expire and are not tied to one person, stored in separate secure physical locations.
  • A dedicated security group excluded from Conditional Access policies that block or restrict sign-in. Report-only policies do not need the exclusion.
  • Monitoring: alert on any sign-in or audit event for these accounts. They should be silent. Any activity is either a real emergency or an incident.
  • A test every quarter, so you know they still work with your current Conditional Access policies.

Mistakes we see

  • Making everyone eligible for Global Administrator when a narrower role would do the job.
  • Activation windows of 24 hours, which recreate standing access with extra clicks.
  • Excluding the emergency accounts and then not alerting on them, which leaves an unwatched backdoor.
  • One emergency account, or two that share the same passkey device in the same drawer.
  • Never testing the approval path until the day it is needed.

What this does not do

PIM limits and records privileged use. It does not stop a user who activates a role and is then tricked. Pair it with phishing-resistant MFA, Conditional Access for admins and alerts on role activation. We design and test this setup for small tenants as scoped, authorized work.

Sources

This article is general information, not legal or technical advice for your environment. Product menus, license names and provider rules change; check the vendor's current documentation before you act. Last reviewed .

Next article

Related reading

Need help with this?

We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.

Managed IT Services