How to use PIM for just-in-time admin roles

What this check looks at

Checks whether privileged roles are activated on demand rather than held permanently, where Entra ID P2 is licensed.

By default a Microsoft Entra role assignment is active and permanent: the account holds Global Administrator, Exchange Administrator or any other role every minute of every day, whether or not the person is doing admin work. Privileged Identity Management (PIM), part of Microsoft Entra ID P2 (included in Microsoft 365 E5 and available as an add-on), lets roles be assigned as eligible instead: the person activates the role when needed, for a limited time, with MFA, a written justification and, where required, an approver.

This check only applies where the tenant holds Entra ID P2. It counts privileged role holders whose roles are all permanent, leaving out emergency access accounts, which should stay permanent. The check fails when 40 per cent or more of privileged accounts hold their roles permanently; it warns when some standing assignments remain but they are under 40 per cent; it passes when only emergency access accounts are permanently assigned.

Standing privilege means a stolen session, a malicious browser extension or a phished password gives an attacker admin rights immediately and at any hour. With PIM the same theft gives only an eligible assignment that still needs MFA, a justification and possibly another administrator’s approval to activate, and every activation is logged and can raise an alert, so misuse is slower and visible.

Why it matters

Standing privilege is privilege available to an attacker at any hour. Just-in-time activation with approval and justification shrinks the window from permanent to minutes, and produces an audit record of every elevation.

A typical case: a 200-person charity managed by an MSP has five permanent Global and Exchange Administrators. An attacker steals one administrator’s session through an adversary-in-the-middle phishing page and, because the role is always active, immediately adds forwarding to the chief executive’s mailbox and grants an app access to every mailbox. Under PIM the stolen session would have carried no admin rights, and activating Global Administrator would have needed another administrator to approve it.

PIM also produces the audit trail that auditors and cyber insurers ask for: who elevated, when, why and for how long. For a business already paying for Entra ID P2, leaving roles permanent wastes a control it has bought.

CIS Microsoft 365 Foundations Benchmark 5.3.1 asks for Privileged Identity Management to be used to manage roles; CISA SCuBA MS.AAD.7.4 forbids permanent active assignments to highly privileged roles (emergency accounts excepted) and MS.AAD.7.5 asks for them to be provisioned only through a privileged access management system. CIS Controls v8 safeguard 6.8, ISO 27001 A.8.2 and A.5.18 and the NCSC CAF privileged user management outcome expect privilege to be limited in time as well as scope.

How to fix it

Where: Entra admin centre → Identity governance → Privileged Identity Management

Before you start

• Confirm the tenant has Entra ID P2 (PIM needs it).
• Decide per role: maximum activation time, whether approval is needed, and who approves.

Step by step

1. 1Check licences and plan the role settings. Confirm each administrator who will use PIM has an Entra ID P2 licence. For each role in use, decide the maximum activation time (one to four hours is typical), whether approval is needed (yes for Global Administrator and Privileged Role Administrator) and who approves (at least two named people, never only the requester).
2. 2Configure the Global Administrator role settings. In the Microsoft Entra admin centre go to ID Governance > Privileged Identity Management > Microsoft Entra roles > Settings, open Global Administrator and select Edit. On the Activation tab set the maximum duration, require multifactor authentication on activation (shown as Azure MFA in some tenants), require justification, and require approval with your named approvers. On the Assignment tab allow permanent eligible assignment and make active assignments expire. On the Notification tab send activation alerts to the administrators. Select Update.
3. 3Configure the other privileged roles. Apply the same settings to every other privileged role in use (Privileged Role, Security, Exchange, SharePoint, Teams, User, Helpdesk, Authentication, Application and Cloud Application Administrator, and any others in the evidence). Approval can be left off for lower-impact roles; keep MFA and justification on for all of them.
4. 4Add eligible assignments first. In Privileged Identity Management > Microsoft Entra roles > Roles, open each role, select Add assignments, choose the person, and on the Settings page choose Assignment type: Eligible, with Permanently eligible ticked (or an end date for contractors). Do this before removing anything, so nobody loses access part-way through.
5. 5Remove the permanent active assignments. On each role’s Assignments page, open the Active assignments tab and remove every permanent active assignment that now has a matching eligible one. Leave the two emergency access accounts as permanent active Global Administrators; this check leaves them out by design.
6. 6Test an activation with each administrator. Ask each administrator to open Privileged Identity Management > My roles > Microsoft Entra roles, select Activate on their role, give a reason and complete MFA. For Global Administrator, check the approver receives the request and approves it, that the person can then do their task, and that the role drops away when the time runs out.
7. 7Turn on PIM alerts. In Privileged Identity Management > Microsoft Entra roles > Alerts, open Settings and make sure the alerts for roles assigned outside PIM, too many Global Administrators and roles not requiring MFA for activation are on. If sign-in and audit logs go to a Log Analytics workspace, add an alert for activations outside business hours.
8. 8Confirm only emergency accounts are standing. In Privileged Identity Management > Microsoft Entra roles > Assignments, filter on Active assignments: only the emergency access accounts should appear for privileged roles, and every administrator should appear under Eligible assignments. The finding clears at the next assessment.

What users will notice

Administrators activate a role when they need it, with a reason, instead of holding it all the time. Activation takes under a minute.

How to confirm it worked

In Privileged Identity Management, Roles, Assignments: privileged roles show Eligible assignments, with Active assignments limited to break-glass accounts.

Frameworks and controls

This check maps to controls in 18 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

• Privileged Identity Management (Microsoft Learn)

Related checks

• Why admin accounts should be cloud-only in Microsoft 365
• Disabled and dormant accounts that still hold admin roles
• How to get alerts when admin roles are assigned in PIM
• How to set up access reviews for privileged roles

The full Microsoft 365 security checklist, worst first