Microsoft Entra Privileged Identity Management (PIM)

Microsoft Entra Privileged Identity Management (PIM): A Complete Guide for SC-900

Why Is Microsoft Entra Privileged Identity Management (PIM) Important?

In every organization, certain accounts have elevated privileges — they can manage users, configure security settings, access sensitive data, or modify critical infrastructure. These privileged accounts are prime targets for attackers. If a malicious actor gains control of a privileged account, the consequences can be devastating: data breaches, service disruption, and compliance violations.

The core problem is that many organizations grant permanent, always-on privileged access to users who may only need those permissions occasionally. This creates an unnecessarily large attack surface. Microsoft Entra Privileged Identity Management (PIM) was designed to solve exactly this problem by enforcing the principle of least privilege and just-in-time (JIT) access.

What Is Microsoft Entra Privileged Identity Management (PIM)?

Microsoft Entra Privileged Identity Management (PIM) is a service within Microsoft Entra ID (formerly Azure Active Directory) that enables organizations to manage, control, and monitor access to important resources. PIM helps reduce the risks associated with excessive, unnecessary, or misused access permissions.

PIM covers privileged access to:
- Microsoft Entra ID roles (e.g., Global Administrator, User Administrator)
- Azure resource roles (e.g., Owner, Contributor, User Access Administrator on subscriptions, resource groups, or individual resources)
- Microsoft 365 roles and other services integrated with Entra ID

At its core, PIM transforms permanent privileged access into eligible access. Instead of a user always having the Global Administrator role, they are made eligible for it. When they actually need the role, they must activate it — and that activation is time-limited, audited, and can require approval.

How Does PIM Work?

Understanding PIM requires understanding several key concepts and the workflow involved:

1. Eligible vs. Active Assignments

- Eligible Assignment: The user does NOT currently have the role. They are eligible to activate it when needed. Think of it like having a key to a locked room — you have access to the key, but you must consciously use it to enter.
- Active Assignment: The user currently HAS the role and can exercise its permissions. This can be permanent or time-bound.

The primary goal of PIM is to move users from permanent active assignments to eligible assignments.

2. Just-in-Time (JIT) Access

When a user with an eligible assignment needs to perform a privileged task, they activate the role. This activation is temporary — it lasts for a configured duration (e.g., 1 hour, 4 hours, up to 24 hours). Once the activation period expires, the role is automatically deactivated, and the user loses the elevated permissions.

3. Activation Workflow

The typical PIM activation workflow is as follows:

- A user recognizes they need a privileged role to complete a task.
- They navigate to PIM in the Azure portal (or My Access portal) and request activation of the eligible role.
- Depending on the policy, they may be required to:
  • Provide a justification (reason for needing access)
  • Complete multi-factor authentication (MFA)
  • Obtain approval from a designated approver
  • Provide a ticket number for change management tracking
- Once all requirements are met, the role is activated for the specified duration.
- After the time expires, the role is automatically deactivated.

4. Approval Workflows

Organizations can configure PIM so that activation of certain high-risk roles (like Global Administrator) requires approval from one or more designated approvers. The approver receives a notification, reviews the request (including the justification), and can approve or deny it.

5. Access Reviews

PIM integrates with Microsoft Entra Access Reviews to periodically review whether users still need their eligible or active role assignments. This ensures that over time, privilege creep does not occur. Reviewers can confirm or remove access during these reviews.

6. Notifications and Alerts

PIM provides built-in notifications and alerts, including:
- Email notifications when roles are activated
- Alerts when roles are assigned outside of PIM
- Alerts for redundant or unused role assignments
- Notifications to approvers when approval is required

7. Audit Logs and Reporting

Every action in PIM is logged and auditable. This includes role assignments, activations, approvals, denials, and deactivations. These logs are critical for compliance and security investigations. You can view up to 30 days of PIM audit history directly, and longer retention is available through integration with Azure Monitor or SIEM solutions.

Key Features Summary

- Just-in-time privileged access to Entra ID and Azure resources
- Time-bound access with automatic deactivation (start and end dates)
- Approval-based activation for specific roles
- MFA enforcement upon role activation
- Justification requirements to understand why activation is needed
- Notifications when privileged roles are activated
- Access reviews to ensure continued need for roles
- Audit history for internal or external audit compliance
- Alerts for suspicious or unnecessary privilege assignments

Licensing Requirements

PIM requires Microsoft Entra ID P2 (formerly Azure AD Premium P2) or Microsoft Entra ID Governance licenses. This is important for the exam — PIM is a premium feature, not available in free or P1 tiers.

Real-World Scenario

Consider a help desk administrator named Sarah. In a traditional setup, Sarah might be permanently assigned the User Administrator role so she can reset passwords. With PIM:

- Sarah is made eligible for the User Administrator role.
- When she needs to reset a password, she activates the role in PIM.
- She provides a justification: "Resetting password for user John.Smith per ticket #4521."
- She completes MFA verification.
- The role is activated for 2 hours.
- After 2 hours, the role automatically deactivates.
- The entire process is logged and auditable.

If Sarah's account were compromised outside of that 2-hour window, the attacker would NOT have User Administrator privileges.

PIM vs. Conditional Access vs. Access Reviews

Students often confuse these related concepts:

- Conditional Access: Policies that control how and when users can sign in (based on conditions like location, device, risk). It does not manage role assignments.
- PIM: Manages who has privileged roles and when they can use them. Focused specifically on privileged access management.
- Access Reviews: Periodic reviews of access (can be used with PIM or independently). Ensures ongoing appropriateness of access.

PIM can require Conditional Access policies (like MFA) during activation, and PIM integrates with Access Reviews, but they are distinct capabilities.

---

Exam Tips: Answering Questions on Microsoft Entra Privileged Identity Management (PIM)

Tip 1: Know the Core Purpose
If a question asks about reducing standing (permanent) privileged access, enforcing just-in-time access, or applying the principle of least privilege to administrative roles, the answer is almost always PIM. PIM's primary value proposition is eliminating always-on privileged access.

Tip 2: Eligible vs. Active Is Frequently Tested
Understand the difference between eligible and active assignments. Questions may describe a scenario where a user has a role but cannot currently use it — that user has an eligible assignment and needs to activate it.

Tip 3: Remember the Activation Requirements
PIM can enforce MFA, justification, approval, time limits, and ticketing information during activation. If a question mentions any of these requirements in the context of privileged role management, think PIM.

Tip 4: PIM Requires Entra ID P2
If a question asks which license tier is needed for PIM, the answer is Microsoft Entra ID P2 (or Microsoft Entra ID Governance). This is a commonly tested detail on SC-900.

Tip 5: PIM Covers Both Entra ID Roles and Azure Resource Roles
Do not assume PIM only works with Entra ID directory roles. It also manages Azure resource roles (Owner, Contributor, etc. at the subscription, resource group, or resource level).

Tip 6: Watch for Keywords in Scenarios
Look for these keywords and phrases that signal PIM as the correct answer:
- "Just-in-time access"
- "Time-bound role activation"
- "Reduce standing access"
- "Require approval for role activation"
- "Enforce MFA for privileged role use"
- "Audit privileged role assignments"
- "Eligible for a role"

Tip 7: Distinguish PIM from Conditional Access
If a question is about controlling sign-in conditions (location, device state, risk level), the answer is Conditional Access. If the question is about controlling when and how a user can use a privileged role, the answer is PIM. Both can enforce MFA, but in different contexts.

Tip 8: Access Reviews + PIM Integration
Questions may describe periodic review of role assignments. While Access Reviews is the feature that performs the review, PIM is where you would configure access reviews for privileged roles. If the question context is about reviewing whether users still need their privileged role assignments, both concepts may be relevant — but PIM is the overarching governance tool for privileged access.

Tip 9: PIM Is a Zero Trust Enabler
SC-900 emphasizes Zero Trust principles. PIM directly supports the Zero Trust principle of "Use least privilege access" by ensuring users only have elevated permissions when they truly need them. If a question links Zero Trust to privileged access, PIM is the answer.

Tip 10: Think About the Audit Trail
If a question mentions needing an audit trail of who activated privileged roles, when, why, and for how long — PIM provides this. Every activation, approval, and deactivation is logged.

Summary

Microsoft Entra Privileged Identity Management (PIM) is a critical security service that transforms how organizations manage privileged access. By converting permanent role assignments to eligible, just-in-time assignments with time limits, MFA, approval workflows, and full audit logging, PIM dramatically reduces the risk of privileged account compromise. For the SC-900 exam, remember that PIM is the go-to solution whenever a question involves managing, controlling, or monitoring privileged access to Microsoft Entra ID roles or Azure resources.