Entra ID Privileged Identity Management: Rolling Out Just-in-Time Admin Access

Your Global Administrators have permanent, always-on access to your tenant. Every one of those accounts is a loaded gun sitting on the table 24 hours a day — and attackers know it. The 2023 Microsoft Digital Defense Report found that compromised privileged accounts remain the most common entry point into enterprise cloud environments. The antidote is just-in-time (JIT) access: roles are assigned eligible rather than active, meaning they only fire when an admin explicitly requests elevation, justifies it, and — optionally — gets a human approval.

Microsoft Entra Privileged Identity Management (PIM) is the engine that operationalises this model inside Entra ID. This tutorial walks you through a complete entra privileged identity management setup: from the first licence check to your first governed role activation, including approval workflows, notification alerts, and access reviews. By the end you will have replaced standing admin access with a repeatable, auditable process.

---

Prerequisites

Before you touch PIM settings, confirm the following:

Licence nuance: As of the Microsoft Entra ID licensing documentation, you need one P2 licence per unique user interacting with PIM — not per role assignment. A single admin holding three eligible roles only consumes one licence.

---

Architecture Overview

Understanding the flow before you click anything prevents misconfigurations later. PIM sits between the identity plane and the role assignment plane:

flowchart TD
    A([Admin requests role activation]) --> B{PIM Policy\nfor that role}
    B -->|Approval required| C[Approver notified\nvia email + Teams]
    C --> D{Approver decision}
    D -->|Approved| E[Active role assigned\nfor configured duration]
    D -->|Denied / timeout| F[Request rejected\nAdmin notified]
    B -->|No approval required| E
    E --> G[Admin performs\nprivileged work]
    G --> H[Role expires\nautomatically]
    H --> I[(Audit log:\nactivation, justification,\napprover, duration)]
    B -->|Always MFA + justification| A

The key insight is that the underlying Azure RBAC or Entra ID role assignment never disappears — it is held in an eligible state by PIM, which only promotes it to active during the approved window.

---

Step 1 — Enable PIM for Your Tenant

PIM requires a one-time consent from a Global Administrator.

1. Sign in to the Entra admin centre as Global Administrator.
2. Navigate to Identity Governance → Privileged Identity Management.
3. Click Consent to PIM and complete the MFA prompt.

Once consented, PIM is active for the tenant. There is no rollback option after consent, but no roles are affected yet — nothing changes until you create an assignment.

---

Step 2 — Configure Role Settings Before Creating Assignments

A common mistake is creating eligible assignments first and discovering later that the default policy is too permissive (or too restrictive) for your environment. Configure the role settings template before any assignments exist.

Open Role Settings

1. In PIM, select Entra ID roles → Role settings.
2. Choose the role you want to govern — start with Global Administrator.

Recommended Settings for Privileged Roles

The table below maps the setting to the portal control and the rationale:

Default behaviour warning: By default, PIM allows permanent eligible assignments with no expiry and no approval requirement on activation. The defaults are intentionally permissive to ease adoption, but they are not a production security posture.

Apply identical settings to: Security Administrator, Exchange Administrator, SharePoint Administrator, and User Access Administrator. For lower-privilege roles like Reports Reader you can relax the approval requirement while keeping MFA and justification.

# Inspect current role policy settings via Microsoft Graph PowerShell
# Install-Module Microsoft.Graph -Scope CurrentUser

Connect-MgGraph -Scopes "RoleManagementPolicy.Read.Directory"

# List all Entra ID role management policies
Get-MgPolicyRoleManagementPolicy -Filter "scopeId eq '/' and scopeType eq 'DirectoryRole'" |
    Select-Object Id, DisplayName |
    Sort-Object DisplayName

---

Step 3 — Create Eligible Assignments

With the role settings locked down, you are ready to assign users as eligible for roles.

Via the Entra Admin Centre

1. In PIM, navigate to Entra ID roles → Assignments → Add assignments.
2. Select Global Administrator as the role.
3. Under Membership type, choose Eligible (not Active).
4. Search for and select the target user.
5. Set an expiry date — enforce the 365-day maximum you configured in Step 2.
6. Click Assign and confirm.

Via Microsoft Graph PowerShell (Bulk Assignments)

For rolling out PIM across a team of 20+ admins, scripting is faster and auditable:

Connect-MgGraph -Scopes "RoleAssignmentSchedule.ReadWrite.Directory", `
                         "RoleEligibilitySchedule.ReadWrite.Directory", `
                         "Directory.Read.All"

# Retrieve the role definition ID for Global Administrator
$roleDefinition = Get-MgRoleManagementDirectoryRoleDefinition `
    -Filter "displayName eq 'Global Administrator'"

# Array of UPNs to make eligible
$eligibleAdmins = @(
    "alice@contoso.com",
    "bob@contoso.com",
    "carol@contoso.com"
)

$startTime = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
$endTime   = (Get-Date).AddDays(365).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")

foreach ($upn in $eligibleAdmins) {
    $user = Get-MgUser -UserId $upn

    $params = @{
        action           = "adminAssign"
        justification    = "PIM rollout: baseline eligible assignment"
        roleDefinitionId = $roleDefinition.Id
        directoryScopeId = "/"
        principalId      = $user.Id
        scheduleInfo     = @{
            startDateTime = $startTime
            expiration    = @{
                type        = "AfterDateTime"
                endDateTime = $endTime
            }
        }
    }

    New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter $params
    Write-Host "Eligible assignment created for $upn"
}

Pitfall: If you attempt to create an eligible assignment for a user who already has a permanent active assignment to the same role, PIM will not error — it will silently co-exist. The permanent active assignment still wins. Remove standing active assignments before or immediately after creating the eligible ones, or the JIT model is bypassed entirely.

---

Step 4 — Configure Approval Workflows

Requiring approval on Global Administrator activation is where PIM earns its keep in a Zero Trust architecture.

1. Return to Entra ID roles → Role settings → Global Administrator.
2. Under Activation, toggle Require approval to On.
3. Click Select approvers and add a security group (e.g., sg-pim-approvers) rather than individual users — this future-proofs approver changes.
4. Set Approval timeout to 24 hours (requests expire after this window).
5. Save settings.

Approvers receive an email notification and can also act from the PIM portal at Approve requests.

# Query pending PIM approval requests via Graph — useful for SOC dashboards
Connect-MgGraph -Scopes "PrivilegedEligibilitySchedule.Read.Directory", `
                         "RoleAssignmentScheduleRequest.ReadWrite.Directory"

Get-MgRoleManagementDirectoryRoleAssignmentScheduleRequest `
    -Filter "status eq 'PendingApproval'" |
    Select-Object PrincipalId, RoleDefinitionId, CreatedDateTime, Status

Approver Experience

When an admin activates an eligible Global Administrator role, approvers receive an email within two minutes. The email links directly to the approval pane where they see:

• The requestor's name and UPN
• The justification text and ticket number they entered
• The requested duration
• Approve or Deny buttons with a mandatory reason field

---

Step 5 — Set Up PIM Alerts and Notifications

PIM ships with built-in security alerts that fire on suspicious patterns. Enable them in Entra ID roles → Alerts.

Critical alerts to verify are active:

Route alert notifications to your SOC distribution list via the Notification settings tab on each role. For high-fidelity alerting, pipe PIM audit logs into Sentinel:

# ARM template deployment — connect Entra audit logs to a Log Analytics workspace
az monitor diagnostic-settings create \
  --name "entra-pim-to-sentinel" \
  --resource "/providers/Microsoft.aadiam" \
  --resource-type "Microsoft.aadiam/diagnosticSettings" \
  --workspace "/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.OperationalInsights/workspaces/<workspace>" \
  --logs '[
    {"category": "AuditLogs",        "enabled": true},
    {"category": "SignInLogs",        "enabled": true},
    {"category": "RiskyUsers",        "enabled": true}
  ]'

Then in Sentinel, query PIM activations with:

AuditLogs
| where OperationName == "Add member to role completed (PIM activation)"
| extend
    ActivatedRole  = tostring(TargetResources[0].displayName),
    RequestedBy    = tostring(InitiatedBy.user.userPrincipalName),
    Justification  = tostring(AdditionalDetails[?(@.key == "justification")].value)
| project TimeGenerated, RequestedBy, ActivatedRole, Justification, ResultDescription
| order by TimeGenerated desc

---

Step 6 — Schedule Access Reviews

JIT access without periodic reviews still accumulates drift. PIM integrates with Entra ID Access Reviews to enforce recertification of eligible assignments.

1. Go to Identity Governance → Access reviews → New access review.
2. Scope: Privileged roles → select Global Administrator, Security Administrator, Exchange Administrator.
3. Reviewers: Role owners (self-review) plus a secondary reviewer (their manager or a security team member).
4. Frequency: Quarterly.
5. Auto-apply results: Enable — assignments with no response after the review period are automatically removed.
6. Duration: 14 days.

The auto-apply setting is the operationally important one. Without it, a review that concludes "deny" still requires a human to execute the removal. With it, the governance loop is closed automatically.

---

Proving It Works — First Activation End to End

Run through this verification procedure after completing Steps 1–6:

1. Sign in as one of the newly eligible administrators (use a separate browser session or InPrivate window).
2. Navigate to myaccess.microsoft.com → Roles → locate the eligible Global Administrator role.
3. Click Activate, enter a justification (e.g., "Testing PIM rollout per change ticket CHG0012345"), set duration to 1 hour, submit.
4. If approval is required: switch to an approver session, navigate to PIM → Approve requests, approve the request.
5. Return to the requestor session — the role should show Active within 60 seconds of approval.
6. Verify in Entra admin centre → Users → [requestor] → Assigned roles — the Global Administrator role should appear with an expiry timestamp.
7. After the activation window expires (or click Deactivate), confirm the role disappears from the assigned roles list.

In Sentinel or the Entra audit log, you should see entries for Add eligible member to role, Add member to role completed (PIM activation), and Remove member from role (PIM deactivation).

---

Common Pitfalls to Avoid

Leaving the break-glass account eligible instead of permanently active. Break-glass accounts exist precisely because PIM could be unavailable during a catastrophic incident. Keep them as permanent active assignments — but lock them down with strong credentials, hardware FIDO2 keys, and Conditional Access exclusions scoped only to that account.

Not removing existing standing assignments. After creating eligible assignments, many teams forget to revoke the old permanent active role assignments. Run this query regularly:

# Find permanent active Entra ID role assignments not managed by PIM
Connect-MgGraph -Scopes "RoleManagement.Read.Directory"

Get-MgRoleManagementDirectoryRoleAssignment -All |
    Where-Object { $_.PrincipalId -ne $null } |
    Select-Object PrincipalId, RoleDefinitionId, DirectoryScopeId |
    ForEach-Object {
        $roleName = (Get-MgRoleManagementDirectoryRoleDefinition -UnifiedRoleDefinitionId $_.RoleDefinitionId).DisplayName
        $user     = (Get-MgUser -UserId $_.PrincipalId -ErrorAction SilentlyContinue).UserPrincipalName
        [PSCustomObject]@{
            User     = $user
            Role     = $roleName
            ScopeId  = $_.DirectoryScopeId
        }
    } | Where-Object { $_.User -ne $null } | Sort-Object Role

Compare the output against your PIM-managed eligible assignments list. Any role in this output that also exists as an eligible assignment is a bypass risk.

Setting maximum activation duration too long. An 8-hour or 24-hour window eliminates most of the benefit of JIT access. Start at 4 hours for privileged roles, and tune down based on your operational data from the first 90 days.

Skipping the ticket number requirement. Justification text is easy to game ("routine maintenance"). Requiring a valid ITSM ticket number, even if PIM cannot validate the ticket, adds a social contract and creates a correlation point during incident investigations.

---

What to Do in the First 30 Days

The biggest risk after go-live is operational friction causing admins to work around PIM rather than through it. Manage the rollout in phases:

• Days 1–7: Apply PIM to Global Administrator and Security Administrator only. Leave other roles as standing. Monitor activation patterns.
• Days 8–21: Extend PIM to Exchange Administrator, SharePoint Administrator, User Access Administrator, and Teams Administrator. Hold a 15-minute "how to activate" briefing for affected admins.
• Days 22–30: Run your first ad-hoc access review. Identify eligible assignments that have never been activated — these are candidates for removal at the first quarterly review.

Track the ratio of eligible activations per week versus standing active assignments. As that ratio climbs toward 1:0, your standing privilege surface is shrinking.

---

Key Takeaways

• Configure role settings first, assignments second — the default PIM policy is not a production security posture.
• Always pair eligible assignments with removal of the corresponding standing active assignments or JIT is bypassed silently.
• Route PIM audit logs to Microsoft Sentinel on day one so investigation data exists before you need it.
• Use security groups as approvers, not individual accounts, to eliminate single points of failure in approval chains.
• Break-glass accounts are the only legitimate exception to JIT — document them, monitor them separately, and revisit them every six months.

Related Articles

• Entra ID Workload Identity Federation: Eliminating Secrets in CI/CD Pipelines
• Conditional Access Gap Analysis: Finding and Fixing Coverage Holes with What-If
• Missing AI Guardrails: When Your Copilot Serves Data Users Shouldn't See