PIM: Protect Your Privileged Roles

What is Privileged Identity Management (PIM)?

Eligible vs Active assignments

This is the most fundamental PIM concept and appears in nearly every exam question:

Feature	Eligible Assignment	Active Assignment
Standing access?	No — must activate when needed	Yes — always has the role
Activation required?	Yes — user must request activation	No — role is always on
Time-limited?	Activation expires after configured duration	Can be permanent or time-bound
Approval needed?	Configurable — can require approval	No activation, so no approval step
Security posture	Strong — minimises standing access	Weaker — permanent privileged access
Best for	Day-to-day admin tasks	Break-glass accounts, service accounts
Exam preference	Recommended approach for most roles	Use sparingly and justify

The golden rule: Make roles eligible unless there’s a specific reason for active (break-glass accounts, automated service accounts that can’t interactively activate).

The activation workflow

When a user with an eligible assignment needs to use their role, this is what happens:

User requests activation
        ↓
MFA required? → Authenticate with MFA
        ↓
Justification required? → Provide reason
        ↓
Ticket number required? → Enter ticket reference
        ↓
Approval required? → Approver gets notification → Approve/Deny
        ↓
Activation granted (time-limited)
        ↓
Timer expires → Role automatically deactivated

ℹ️ Scenario: Priya configures PIM for Global Admin

🔐 Priya at Meridian Health configures PIM for the Global Administrator role:

PIM role settings for Global Admin:

• Maximum activation duration: 2 hours (admins must re-activate if they need more time)
• Require MFA on activation: Yes
• Require justification: Yes
• Require approval: Yes — approved by Priya or the CTO
• Require ticket number: Yes (must reference a change request)
• Send notification when activated: Yes — security team gets an email

Eligible assignments:

• Priya herself (identity architect)
• Marcus (senior infrastructure admin)
• One break-glass account → Active permanent assignment (can’t interactively activate)

Now when Marcus needs Global Admin to perform a tenant-wide change, he:

1. Goes to the PIM blade in the Entra admin center (or myaccess.microsoft.com)
2. Selects Global Administrator → Activate
3. Completes MFA
4. Enters justification: “Deploying new Conditional Access policies per CHG-4521”
5. Enters ticket number: CHG-4521
6. Priya receives an approval request → Approves
7. Marcus has Global Admin for 2 hours → role deactivates automatically

PIM role settings — the control panel

Each Entra role has independent PIM settings. You configure settings per role, not globally.

Setting	What It Controls	Typical Config
Max activation duration	How long the role stays active after activation	1–24 hours (default 8h, use 1–4h for sensitive roles)
Require MFA	MFA required when activating	Always Yes for privileged roles
Require justification	User must explain why they need the role	Yes for most roles
Require approval	Approval needed before activation	Yes for Global Admin, Privileged Role Admin; optional for less sensitive roles
Require ticket information	Must provide a ticket/change request number	Yes for change-managed environments
Allow permanent eligible	Can eligible assignments be permanent (no end date)?	Yes — eligible is safe even if permanent
Allow permanent active	Can active assignments be permanent?	No for most roles (exception: break-glass)
Require Azure MFA (not claims)	Specifically requires Entra MFA, not federated claims	Recommended for highest security
Assignment notifications	Email when someone is assigned the role	Yes — security team should know
Activation notifications	Email when someone activates the role	Yes — security team should know

💡 Exam tip: Settings are per-role

PIM settings are configured per role, not globally. You might require approval for Global Admin but not for Helpdesk Admin. The exam tests whether you know that changing the Global Admin PIM settings does NOT affect User Admin settings — they’re independent.

Also note: Privileged Role Administrator is the role that manages PIM settings — not Global Admin specifically (though Global Admin can do everything).

Managing the approval process

When a role requires approval, designated approvers receive notifications:

Approver experience:

1. Receive email notification (or check PIM in the portal)
2. See the request details: who, which role, justification, ticket number
3. Approve or Deny with a reason
4. If approved, the user’s role activates immediately

If the approver doesn’t respond:

• The request times out after the configured period (default 24 hours)
• The user’s activation is denied
• The user can re-request

ℹ️ Scenario: Priya approves Marcus's Global Admin activation

🔐 Marcus requests Global Admin activation. Priya receives an email:

PIM Activation Request User: Marcus Chen Role: Global Administrator Justification: “Deploying new Conditional Access policies per CHG-4521” Ticket: CHG-4521 Duration: 2 hours

Priya checks the change management system, confirms CHG-4521 is a legitimate approved change, and clicks Approve. Marcus immediately has Global Admin for 2 hours.

After the change, Marcus can deactivate early (best practice) or let the 2-hour timer expire automatically.

Assignment types: eligible vs active, permanent vs time-bound

PIM assignments have two independent dimensions:

	Eligible	Active
Permanent	User is always eligible to activate (no end date)	User always has the role (no end date) — avoid this
Time-bound	User is eligible to activate until the end date	User has the role until the end date

Best practices:

• Permanent eligible is fine — the user can activate when needed, and it doesn’t expire
• Time-bound eligible is great for contractors or project-based access
• Time-bound active is acceptable for temporary scenarios
• Permanent active should be reserved for break-glass accounts only

💡 Exam tip: Maximum assignment duration

In PIM role settings, you can set a maximum duration for both eligible and active assignments. If you set “Require expiration” for active assignments with a maximum of 365 days, no one can create a permanent active assignment. This is a governance guardrail.

Activation alerts and notifications

PIM can send notifications at multiple points:

Event	Who Gets Notified
Role assigned (eligible or active)	Assignee, admin, approvers (configurable)
Role activated	Security team, Global Admin, configured recipients
Role deactivated	Configurable
Pending approval	Designated approvers
Role assignment about to expire	Assignee (reminder to renew or re-request)

PIM alerts (separate from notifications):

• Too many Global Admins — triggered when the number exceeds a threshold
• Roles being activated too frequently — possible misuse
• Roles not using PIM for activation — direct active assignments bypassing PIM
• Potential stale role assignments — eligible roles that haven’t been activated in a long time

Video Lesson

🎬 Video coming soon

PIM: Protect Your Privileged Roles

PIM: Protect Your Privileged Roles

~12 min

Key Concepts

Question

What is the difference between an eligible and an active assignment in PIM?

Click or press Enter to reveal answer

Answer

Eligible: the user CAN activate the role when needed — no standing access. Active: the user HAS the role permanently (or until end date) — standing privileged access. Best practice: make assignments eligible and reserve active for break-glass accounts.

Click to flip back

Question

What can you require during PIM role activation?

Click or press Enter to reveal answer

Answer

Four things configurable per role: 1) MFA, 2) Justification (text explanation), 3) Ticket number (change request reference), 4) Approval from designated approvers. Plus the activation has a maximum time limit (1–24 hours).

Click to flip back

Question

Which Entra role manages PIM settings?

Click or press Enter to reveal answer

Answer

Privileged Role Administrator — this role can configure PIM settings, approve activations, and manage role assignments. Global Admin can also manage PIM (Global Admin can do everything), but Privileged Role Admin is the least-privilege role for PIM management.

Click to flip back

Question

Can a user deactivate their PIM role early?

Click or press Enter to reveal answer

Answer

Yes. After activating a role, the user can manually deactivate it before the timer expires. This is a best practice — once you finish the task, deactivate immediately rather than keeping elevated access for the remaining time window.

Click to flip back

Question

What PIM alert fires when too many users have a specific role?

Click or press Enter to reveal answer

Answer

The 'Too many Global Administrators' alert (or similar per-role alerts). PIM monitors the number of active and eligible assignments and alerts when the count exceeds a configurable threshold. This helps enforce the principle of least privilege.

Click to flip back

Knowledge Check

Knowledge Check

Priya wants Global Admin to require MFA, a justification, and approval before activation, with a maximum of 2 hours active time. Where does she configure these requirements?

AConditional Access policies targeting the Global Admin roleBPIM role settings for the Global Administrator roleCEntra ID tenant-wide security settingsDThe user's individual authentication methods settings

Check Answer

Knowledge Check

Marcus is an eligible Global Administrator in PIM. He needs to perform an urgent tenant-wide configuration change but the designated approver (Priya) is on leave. What happens?

AMarcus can bypass approval since PIM allows emergency activationBThe activation request times out after the configured period and Marcus cannot activateCMarcus is automatically promoted to active Global Admin during the emergencyDPIM automatically grants activation if no approver responds within 1 hour

Check Answer

Knowledge Check

Anika is auditing PIM at a client and finds that 12 users have permanent active Global Administrator assignments. What is the recommended remediation?

AThis is fine — Global Admins should always have permanent active access for quick responseBConvert most to eligible assignments, keep only 1-2 break-glass accounts as permanent active, and configure activation to require MFA and approvalCRemove all 12 assignments and use a single shared admin accountDChange all 12 to time-bound active assignments expiring in 30 days

Check Answer

Knowledge Check

Which of these is NOT a configurable requirement for PIM role activation?

ARequire multi-factor authenticationBRequire justification textCRequire the user to be on the corporate networkDRequire approval from a designated approver

Check Answer

Knowledge Check

A user is eligible for the Security Administrator role through PIM with a maximum activation duration of 4 hours. They activate the role at 9:00 AM. At 1:30 PM, they need the role again for an incident. What must they do?

ANothing — the role is still active until 1:00 PM plus any grace periodBRequest activation again because the 4-hour window expired at 1:00 PMCAsk a Global Admin to permanently assign the roleDWait 24 hours before they can re-activate the same role

Check Answer

---

Next up: PIM: Azure Resources, Groups & Audit — extending PIM to Azure subscription roles, using PIM for Groups, auditing PIM activity, and securing break-glass accounts.