Privileged Identity Management (PIM) in Microsoft Entra, explained

Privileged Identity Management (PIM) is Microsoft Entra ID’s way of giving people admin rights only when they need them. Instead of a staff member being a Global Administrator every hour of every day, PIM lets them be eligible for the role and switch it on for a set time, with checks along the way. This page explains how Microsoft describes PIM: eligible and active assignments, just-in-time activation, approval, alerts, access reviews, and the licences Microsoft says it needs.

Why it matters

Admin accounts are valuable to attackers because they can change everything in a tenant. An admin role that’s always on is always available to whoever manages to sign in as that person, whether that’s the real admin or someone who has stolen their sign-in.

Microsoft describes PIM as providing time-based and approval-based role activation to reduce the risks of excessive, unnecessary or misused permissions. The guide to admin roles and least privilege explains the wider idea of giving people only the access they need.

What PIM is

Microsoft defines PIM as “a service in Microsoft Entra ID that enables you to manage, control, and monitor access to important resources in your organization.” Microsoft says those resources include Microsoft Entra ID, Azure, and other Microsoft online services such as Microsoft 365 and Microsoft Intune.

PIM covers three areas, according to Microsoft:

• Microsoft Entra roles, such as Global Administrator, Exchange Administrator or User Administrator
• Azure resource roles, for subscriptions and resources in Azure
• PIM for Groups, for membership or ownership of groups that grant access.

The features Microsoft lists are:

• just-in-time privileged access
• time-bound access with start and end dates
• approval to activate a role
• multifactor authentication to activate any role
• a justification recorded for each activation
• notifications when a role is activated
• access reviews to confirm people still need roles
• downloadable audit history
• protection against removing the last active Global Administrator and Privileged Role Administrator assignments.

The guide to Microsoft Entra ID basics explains where Entra ID fits in Microsoft 365.

Licensing

Microsoft’s ID Governance licensing page states: “You need either Microsoft Entra ID Governance licenses or Microsoft Entra ID P2 licenses to use PIM and all of its settings.” Microsoft’s feature table lists PIM under P2 and Governance, but not under P1 or Free.

Microsoft’s Entra licensing page states that Entra ID P1 “is also included in Microsoft 365 Business Premium for small to medium businesses,” and lists P1 in Microsoft 365 E3, E5 and E7. It lists P2 in Microsoft 365 E5 and E7, the Microsoft Defender Suite (formerly Microsoft 365 E5 Security), Enterprise Mobility + Security E5, and, for small and medium businesses, the Microsoft Defender Suite for Microsoft 365 Business Premium and the Microsoft Defender and Purview Suites for Microsoft 365 Business Premium. Microsoft 365 E3 is listed with P1 only. The Microsoft 365 licensing and security features reference sets out which plans Microsoft says include P1 and P2.

Microsoft lists who needs a licence:

• users with eligible or time-bound assignments to Microsoft Entra or Azure roles managed in PIM
• users with eligible or time-bound membership or ownership in PIM for Groups
• users who can approve or reject activation requests
• users assigned to an access review, and users who perform access reviews.

If a P2, ID Governance or trial licence expires, Microsoft says PIM features are no longer available, permanent role assignments to Microsoft Entra roles are unaffected, eligible role assignments are removed, and ongoing access reviews end, with PIM configuration settings removed.

Eligible vs active assignments

Microsoft uses specific terms:

An important point from Microsoft: “There’s no difference in the access given to someone with a permanent versus an eligible role assignment. The only difference is that some people don’t need that access all the time.”

Both kinds of assignment can be permanent or time-bound. Microsoft’s role settings let admins choose whether eligible and active assignments are allowed to be permanent, or expire after a set period.

Just-in-time activation

When an eligible person needs the role, they activate it. Microsoft says activation can involve an MFA check, a business justification, or approval from designated approvers, and that the person chooses how long they need it, up to the maximum the admin has set.

A fictional example: Sam at coastalplumbing.example is eligible for the Exchange Administrator role. Most days Sam signs in as an ordinary user. When a mailbox needs fixing, Sam activates the role for two hours, types a short reason, and completes an MFA prompt. When the two hours are up, the role switches off again. If Sam’s ordinary sign-in were ever stolen, admin rights wouldn’t come with it automatically; whoever used it would still face the activation checks the organisation has set.

Role settings Microsoft describes

Microsoft’s role settings page describes options admins can set for each role:

• Activation maximum duration, which Microsoft says “can be from one to 24 hours.”
• Require MFA on activation. Microsoft notes users “might not be prompted for multifactor authentication if they authenticated with strong credentials or provided multifactor authentication earlier in the session.”
• Require a Conditional Access authentication context as an alternative to MFA, so that a Conditional Access policy decides what’s needed (for example a particular authentication strength or a compliant device). Microsoft says that if no policy targets the context, MFA is required instead. The guide to security defaults vs Conditional Access explains Conditional Access.
• Require justification and require ticket information. Microsoft notes the ticket field is information only and isn’t checked against any ticketing system.
• Require approval. Microsoft says approvers don’t need to hold any role, and recommends selecting at least two approvers. If none are chosen, active Privileged Role Administrators and Global Administrators become the default approvers.
• Notifications. Microsoft describes email notification options, including turning an email off, adding recipients, or sending critical emails only.

Microsoft also warns about a lockout situation: if every Privileged Role Administrator and Global Administrator is eligible rather than active, approval is required, and no approvers are set, nobody may be able to approve an activation. Microsoft’s guidance on emergency access accounts, summarised in the admin roles guide linked above, is relevant here.

How to open PIM role settings

Based on Microsoft’s instructions (checked October 2026). Menus can change; Microsoft’s role settings page has the latest steps.

1. Sign in to the Microsoft Entra admin center (entra.microsoft.com) as at least a Privileged Role Administrator.
2. Go to ID Governance > Privileged Identity Management > Microsoft Entra roles > Roles.
3. Select the role to configure, then select Role settings.
4. Select Edit, change the activation, assignment or notification settings, then select Update.

How to make a role eligible

Based on Microsoft’s instructions (checked October 2026). Menus can change; Microsoft’s role assignment page has the latest steps.

1. Sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator.
2. Go to ID Governance > Privileged Identity Management > Microsoft Entra roles, then select Roles.
3. Select Add assignments, then Select a role, choose the role and the member, and select Next.
4. In the Assignment type list, select Eligible.
5. Set the duration (permanent, or a start and end date for time-bound access), then select Assign.

Microsoft describes time-bound assignments as suiting temporary or contract workers whose end date is known. It also says the last active Global Administrator assignment can’t be removed, and recommends an emergency access account with a permanent active Global Administrator assignment. The guide to emergency access accounts explains how Microsoft describes them.

Where users activate a role

Microsoft’s getting-started page says My roles in Privileged Identity Management “displays a list of eligible and active roles assigned to you” and is where a user can activate any eligible roles. Microsoft’s separate activation article has the current screens.

How approval works

With approval switched on, activation waits until an approver agrees. This adds a second person to each use of a sensitive role. Microsoft’s licensing page notes that the people who approve or reject activation requests also need a PIM licence.

Alerts PIM raises

Microsoft lists security alerts that PIM raises for Microsoft Entra roles, each with a severity:

On the high-severity alert, Microsoft says that role assignments made outside PIM “aren’t properly monitored and might indicate an active attack.” Microsoft states that only Global Administrator, Privileged Role Administrator, Global Reader, Security Administrator and Security Reader can read these alerts. The guide to Microsoft 365 audit logs and alerts covers other logging.

Access reviews

An access review asks a reviewer (or the person themselves) to confirm that someone still needs a role. Microsoft lists access reviews among PIM’s features “to ensure users still need roles.” Microsoft’s licensing page states that access reviews require Microsoft Entra ID Governance for member users who review or are reviewed, while “some capabilities within this feature might operate with a Microsoft Entra ID P2 subscription.”

Things to watch for

• Assignments made outside PIM. Microsoft flags this as a high-severity alert.
• Locking yourself out. Microsoft’s warning about requiring approval with no active admins and no approvers set.
• Too many approvers or none. Microsoft recommends at least two approvers.
• Licence gaps. Microsoft’s list of who needs a licence includes approvers and reviewers, not only admins.
• Licence expiry. According to Microsoft, eligible assignments are removed and PIM settings are lost, while permanent assignments stay.
• Thinking PIM is the whole answer. PIM controls when admin rights are on; sign-in protection such as phishing-resistant MFA methods still matters.

Things that change

Microsoft regularly adds PIM settings and renames roles and licence tiers. Microsoft’s licensing page lists some PIM features, such as custom extensions for role activation, as preview and only under ID Governance. This page reflects Microsoft’s documentation as checked on 21 October 2026.

Common questions

What is Privileged Identity Management in Microsoft 365?

Privileged Identity Management (PIM) is a Microsoft Entra ID service that gives people admin rights only when they need them. Microsoft describes time-based and approval-based role activation to reduce the risks of excessive, unnecessary or misused permissions. It covers Entra roles, Azure resource roles and PIM for Groups, and Microsoft says the resources include Microsoft 365 and Intune. What PIM is lists the features Microsoft describes.

What’s the difference between eligible and active roles in PIM?

Microsoft defines an eligible assignment as one that needs the user to take actions, such as MFA or approval, before using the role, and an active assignment as one that doesn’t. Microsoft says “there’s no difference in the access given”; the only difference is that some people don’t need that access all the time. Eligible vs active assignments has Microsoft’s definitions.

Does Microsoft 365 Business Premium include PIM?

Not on its own, according to Microsoft’s licensing pages. Business Premium includes Entra ID P1, and PIM needs Entra ID P2 or Entra ID Governance. Microsoft lists P2 in the Microsoft Defender Suite for Microsoft 365 Business Premium and the Microsoft Defender and Purview Suites for Microsoft 365 Business Premium. Licensing also lists who needs a licence, including approvers and reviewers.

How long can a PIM role be activated for?

Microsoft’s role settings page says the activation maximum duration can be set from one to 24 hours. The person activating chooses how long they need, up to the maximum the admin has set. Activation can also require MFA, a justification or approval. Role settings Microsoft describes covers each option, and how to open PIM role settings has Microsoft’s steps.

What happens if my PIM licence expires?

Microsoft says PIM features are no longer available if a P2, ID Governance or trial licence expires. Permanent role assignments to Microsoft Entra roles are unaffected, but eligible role assignments are removed, ongoing access reviews end and PIM configuration settings are removed. Licensing has Microsoft’s wording, and things to watch for lists other common gaps.

Who can manage PIM assignments for admin roles?

Microsoft states that for Microsoft Entra roles, only a Privileged Role Administrator or Global Administrator can manage assignments for other administrators. Microsoft’s steps for configuring role settings and making a role eligible start with signing in to the Microsoft Entra admin center as at least a Privileged Role Administrator. How to make a role eligible sets out those steps.

Where to get official help

Microsoft Learn’s PIM overview and role settings page have Microsoft’s current steps. For licensing, Microsoft’s ID Governance licensing page or a Microsoft licensing partner can confirm what a tenant needs.