PIM Entra ID: Configure Just-in-Time Privileged Access

The invisible problem of permanent administrator access

In the majority of Microsoft 365 and Azure tenants, administrator accounts retain their elevated privileges permanently. An account with the Conditional Access Administrator or Global Administrator role has these rights 24 hours a day, 365 days a year — whether it uses them once a week or never.

This model, called standing access (permanent access), is one of the most underestimated attack vectors in cloud environments. If the account is compromised — phishing, credential leak, hijacked session — the attacker immediately inherits all privileges attached to the role, with no limited time window.

Do the math: how many hours of exposure will you reduce?

Let's take a concrete example: an administrator who needs to intervene on conditional access policies about twice a week, for a maximum working session of 8 hours.

• Permanent access: 8,760 hours of exposure per year
• Access limited to actual needs: 2 activations × 8 hours × 52 weeks ≈ 832 hours per year

So we go from permanent exposure to approximately 832 hours, representing a reduction of more than 90% in the time the account is actually privileged.

At the scale of a team of seven administrators performing actions five times a week with the same 8-hour window, we move from approximately 61,320 cumulative hours (7 × 8,760) to approximately 14,560 hours (7 × 5 × 52 × 8) — a reduction of over 75% in the overall attack surface.

This is exactly what Privileged Identity Management (PIM), Microsoft Entra ID's privileged identity governance module, solves.

What is PIM in Microsoft Entra ID?

PIM introduces the concept of just-in-time access: instead of assigning a role permanently (active), you make the user eligible. The user must then explicitly activate their role when needed, for a limited duration, with or without additional controls (MFA, justification, approval).

This feature is found in the Microsoft Entra Admin Center, under Identity Governance > Privileged Identity Management, then Manage access.

Prerequisites and licensing

Other prerequisites:

• A Privileged Role Administrator or Global Administrator role to manage PIM assignments (principle of least privilege: avoid using Global Admin if Privileged Role Administrator is sufficient).
• The Microsoft.Graph.Identity.Governance module if you prefer PowerShell automation.

Configure an eligible assignment via the portal

Automate assignment with Microsoft Graph PowerShell

To scale PIM implementation across multiple accounts, the Microsoft.Graph.Identity.Governance module (Microsoft Graph PowerShell SDK) allows you to create eligible assignments without going through the portal.

Connection with necessary scopes:

1Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory", "RoleEligibilitySchedule.ReadWrite.Directory"

Retrieving the role ID and target user:

1$role = Get-MgRoleManagementDirectoryRoleDefinition -Filter "displayName eq 'Conditional Access Administrator'"
2$user = Get-MgUser -Filter "userPrincipalName eq 'rick.jones@contoso.com'"

Creating the eligible assignment expiring on November 30:

1$params = @{
2    Action = "AdminAssign"
3    PrincipalId = $user.Id
4    RoleDefinitionId = $role.Id
5    DirectoryScopeId = "/"
6    ScheduleInfo = @{
7        StartDateTime = Get-Date
8        Expiration = @{
9            Type = "AfterDateTime"
10            EndDateTime = "2025-11-30T23:59:59Z"
11        }
12    }
13}
14 
15New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter $params

Verifying that the assignment was created and propagated (propagation usually takes a few minutes):

1Get-MgRoleManagementDirectoryRoleEligibilitySchedule -Filter "principalId eq '$($user.Id)'"

On the user side, self-service activation can also be scripted for automation scenarios (runbooks, pipelines):

1$activationParams = @{
2    Action = "SelfActivate"
3    PrincipalId = $user.Id
4    RoleDefinitionId = $role.Id
5    DirectoryScopeId = "/"
6    Justification = "Scheduled update of conditional access policies"
7    ScheduleInfo = @{
8        StartDateTime = Get-Date
9        Expiration = @{
10            Type = "AfterDuration"
11            Duration = "PT8H"
12        }
13    }
14}
15 
16New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest -BodyParameter $activationParams

User experience for the eligible administrator

Once the eligible assignment is in place, the user sees no access to the role until they activate it. In our example, Rick tries to open the conditional access policies: access is denied despite eligibility.

To activate the role, Rick goes to My Roles > Privileged Identity Management > Activate, provides a justification (mandatory if configured), confirms the duration (8 hours by default, reducible but rarely extensible), then validates. The request moves to Activation request is scheduled status, and access becomes available immediately — without standing access.

Troubleshooting common errors

• License error when creating an assignment: the tenant does not have Entra ID P2. Check the license assignment on the relevant user (or on the tenant in case of Entra Suite license).
• The activated role doesn't immediately provide expected access: the user's session token must be refreshed. Request a disconnect/reconnect if the target portal (Intune, Purview, etc.) doesn't yet reflect the active role.
• Unable to activate without satisfied MFA: if the role policy requires MFA on activation, the user must first complete a recent MFA reauthentication in the current session.
• New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest returns a 403 error: the account running the script doesn't have the Privileged Role Administrator role or the necessary Graph scopes (RoleManagement.ReadWrite.Directory).
• The activation request remains pending: if the Require approval to activate option is enabled (preview feature), an approver must manually validate the request before it takes effect.

Key points to remember

• Standing access (permanent access) is a major risk vector too often overlooked in favor of other security controls.
• PIM transforms privileged roles into eligible assignments, activatable just-in-time for a limited duration.
• On a single account, moving from permanent access to targeted activation can reduce exposure by more than 90%; at team scale, the reduction often exceeds 75%.
• Entra ID P2 (M365 E5 or Entra Suite) is a non-negotiable prerequisite — check the license before configuring anything.
• Automation via Microsoft Graph PowerShell (module Microsoft.Graph.Identity.Governance) allows you to scale eligible assignments across multiple accounts or groups.
• Reserve strong constraints (mandatory approval, very short activation window) for the most critical roles like Global Administrator, to avoid unnecessarily slowing down teams on operational roles.

The logical next step is to audit all active administrator roles in your tenant and identify which ones can switch to PIM eligibility without breaking existing processes.