Privileged Identity Management (PIM) in M365

Privileged Identity Management (PIM) is a service in Microsoft Entra ID (formerly Azure AD) that enables you to manage, control, and monitor access to important resources in your organization. PIM provides just-in-time (JIT) privileged access to Microsoft Entra roles and Azure resource roles, ensuring that users only have elevated permissions when they actually need them, for a limited duration, and with approval if required.

Historically, organizations assigned privileged roles (like Global Administrator) to users permanently. This created a security risk: if a privileged account was compromised, an attacker could maintain long-term access. PIM addresses this by:

PIM operates through the concept of eligible assignments vs. active assignments. An eligible assignment means the user is authorized to activate the role but does not have the permissions until they activate it. An active assignment grants the role permanently (like traditional role assignment).

When a user activates an eligible role: 1. The user navigates to the PIM portal or uses the PIM API. 2. They select the role they want to activate. 3. They specify a duration (within the maximum allowed by the administrator). 4. They provide a justification (reason for activation). 5. If approval is required, a request is sent to approvers. 6. Once approved (or if no approval required), the user's token is updated to include the role's permissions. 7. The activation is logged in the audit logs. 8. After the duration expires, the role is automatically deactivated (the user loses the permissions).

PIM is configured via the Microsoft Entra admin center or PowerShell. Key PowerShell cmdlets:

# Get eligible assignments for a role
Get-AzureADMSPrivilegedRoleAssignment -ProviderId "aadRoles" -ResourceId "<tenant-id>" -SubjectId "<user-id>" | Where-Object {$_.AssignmentState -eq "Eligible"}

# Activate a role
Open-AzureADMSPrivilegedRoleAssignmentRequest -ProviderId "aadRoles" -ResourceId "<tenant-id>" -RoleDefinitionId "<role-id>" -SubjectId "<user-id>" -Type "UserAdd" -AssignmentState "Active" -Duration "PT1H" -Reason "Emergency fix"

# Approve a pending request
Approve-AzureADMSPrivilegedRoleAssignmentRequest -ProviderId "aadRoles" -ResourceId "<tenant-id>" -RequestId "<request-id>" -Reason "Approved"

PIM reduces standing access but does not eliminate all risks. Best practices include:

PIM is included in:

Without P2, you cannot use PIM (though you can view settings).

In a large enterprise, PIM is deployed to manage access to critical roles like Global Administrator. For example, Contoso Ltd. has 5 IT staff who occasionally need to perform tenant-wide changes. Instead of giving them permanent Global Admin access, they are made eligible. When a change is needed, they activate the role for 2 hours with approval from the security team. This reduces the attack surface and ensures accountability.

Another scenario: A healthcare organization uses PIM for Azure resource roles. Data scientists need Contributor access to a specific resource group only during a project. They are made eligible for the role, and activation requires MFA and a ticket number from the project management system. This ensures access is traceable and temporary.

Common misconfigurations: Setting activation duration too long (e.g., 8 hours for all roles) defeats the purpose of JIT. Not requiring approval for highly privileged roles like Global Administrator. Forgetting to review and remove eligible assignments for users who no longer need them. These can lead to standing access if not monitored.

Performance considerations: PIM is a control plane service; activation is near-instantaneous. However, token refresh may take a few minutes. In production, administrators should test activation times and ensure that token lifetime policies (default 1 hour for Azure AD tokens) don't interfere with activation duration.

When misconfigured, PIM can cause lockouts: if an administrator accidentally removes themselves from the Global Administrator role without having another eligible admin, they may lose access. Always maintain at least two break-glass accounts with permanent Global Admin access.