Privileged Identity Management (PIM)

Privileged Identity Management (PIM) is a service in Microsoft Entra ID (formerly Azure Active Directory) that enables you to manage, control, and monitor access to important resources in your organization. These resources include Azure AD roles (like Global Administrator, User Administrator) and Azure resources (like subscriptions, resource groups, and individual resources like virtual machines). The core problem PIM solves is the over-assignment of permanent, standing privileged roles. In traditional on-premises environments, administrators often had permanent access to high-privilege accounts, creating a significant security risk if those accounts were compromised. PIM introduces just-in-time (JIT) privileged access, meaning users get the rights they need only when they need them, for a limited time, and with approval if required.

PIM operates on several key mechanisms:

PIM is available with Microsoft Entra ID P2 licenses, which are part of Enterprise Mobility + Security E5 and Microsoft 365 E5. Without P2 licenses, PIM features are limited. Specifically:

In on-premises Active Directory, privileged access management was often handled by manually assigning permanent group memberships (e.g., Domain Admins). There was no built-in JIT activation or approval workflow. Additional third-party tools (like CyberArk) were needed to achieve similar functionality. PIM brings this capability natively to the cloud, integrating with Azure AD and Azure resources.

To use PIM, you navigate to the Microsoft Entra admin center (https://entra.microsoft.com) > Identity > Governance > Privileged Identity Management. From there, you can manage Azure AD roles, Azure resources, and privileged access groups. For automation, you can use Microsoft Graph API or PowerShell cmdlets. For example, to activate a role via PowerShell:

# Example: Activate an Azure AD role using PIM
Open-AzureADMSPrivilegedRoleAssignmentRequest -ProviderId 'aadRoles' -ResourceId 'yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy' -RoleDefinitionId 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' -SubjectId 'zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz' -Type 'UserAdd' -AssignmentState 'Active' -Duration 'PT1H' -Reason 'Need access for incident response'

For Azure CLI, you can use az rest with Microsoft Graph endpoints:

# Example: Activate a role using Azure CLI with Microsoft Graph
az rest --method post --url "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignmentScheduleRequests" --body '{"action":"selfActivate","principalId":"user-id","roleDefinitionId":"role-id","directoryScopeId":"/","justification":"Need for troubleshooting","scheduleInfo":{"startDateTime":"2024-01-01T00:00:00Z","expiration":{"type":"AfterDuration","duration":"PT1H"}}}'

Consider a large enterprise with 50,000 employees. The Global Administrator role is extremely powerful — it has full access to all Azure AD settings and can reset passwords, change policies, and more. Without PIM, if an attacker compromises a Global Admin account, they have unlimited access. With PIM, the Global Admin role is assigned as eligible to only 5 IT staff. When they need to perform a task, they must activate the role via PIM, which requires MFA and approval from a senior security officer. The activation lasts only 2 hours, after which the role is deactivated. This drastically reduces the attack surface and provides a detailed audit log of who did what and when.

A multinational corporation with 10,000 employees has five Global Administrators who manage the entire Azure AD tenant. Previously, these admins had permanent Global Admin rights. After a security audit, the company implemented PIM. Now, the admins are made eligible for Global Admin. When they need to perform tasks like resetting a password or changing a policy, they must activate the role via PIM, which requires MFA and approval from the IT security director. The activation lasts for 2 hours. This change reduced the attack surface significantly: if an admin's credentials are stolen, the attacker cannot activate the role without approval. The company also set up quarterly access reviews to ensure only current employees remain eligible. The cost is the Microsoft Entra ID P2 licenses for the five admins (approx. $9 per user/month). A common mistake is not configuring approval for Global Admin—some organizations skip this to avoid friction, but this defeats the purpose of PIM. When set up incorrectly (e.g., no MFA required), a compromised account could still activate the role, leading to a breach.

A software company uses Azure resources (virtual machines, databases, storage accounts) for development. Developers need Contributor access to specific resource groups, but only during active development sprints. Previously, they were permanently assigned Contributor, which meant they could accidentally delete resources. The company used PIM for Azure resources to grant eligible Contributor access. Developers activate the role when they start work each day, and it expires after 8 hours. This ensures that after hours, no one has persistent write access. The team also set up approval for high-risk actions like deleting resource groups. The result: fewer accidental deletions and better security. The cost is P2 licenses for the developers (approx. $9/user/month). A common misconfiguration is setting the activation duration too long (e.g., 8 hours) without approval, which still leaves a window for misuse. Best practice is to set the shortest practical duration and require approval for destructive actions.

A financial services firm hires external auditors who need temporary read-only access to Azure AD audit logs and Azure resource configurations. Without PIM, the firm would have to create permanent guest accounts with permanent roles, which is a security risk. Using PIM, the auditors are invited as guest users and made eligible for the 'Security Reader' role. They activate the role only when performing the audit, with a 4-hour duration and approval from the compliance officer. After the audit, their eligibility expires automatically based on a set end date. This provides a clean audit trail and ensures access is revoked when no longer needed. The firm saves time on manual cleanup and reduces the risk of lingering access. A pitfall is not setting an expiration on eligibility, which could allow the auditor to reactivate later. Proper configuration includes a definite end date for the eligibility assignment.