2.1 Privileged Identity Management (PIM)

2.1 Privileged Identity Management (PIM)

Quick Answer: PIM is Microsoft Entra’s service for just-in-time (JIT) privileged access. Prefer eligible role assignments that users activate for a limited window (often with MFA, justification, and optional approval) instead of active/permanent standing admin rights. PIM manages Microsoft Entra roles, Azure resource RBAC roles, and privileged groups—and access reviews keep assignments honest.

On SC-500, securing access with Microsoft Entra ID is a core skill under Manage identity, access, and governance. PIM is the primary control for reducing permanent Global Administrators and other high-blast-radius roles while still letting operators do their jobs.

Why PIM Exists

Standing privileged accounts are a top attack path. If a Global Administrator credential is phished or a session is stolen, the attacker already has full tenant control. PIM shrinks that window:

• Privileges appear only when needed (just-in-time)
• Activation can demand MFA, a business justification, and approver sign-off
• Assignments can be time-bound (start/end dates)
• Notifications and audit history create accountability
• Access reviews force periodic re-justification of who still needs the role

PIM also protects critical directory roles by preventing removal of the last active Global Administrator and Privileged Role Administrator assignments—so you cannot lock yourself out of role management.

Eligible vs Active Assignments (Exam Critical)

There is no difference in permission scope between a permanent active assignment and a successfully activated eligible assignment. The only difference is when the privileges exist. Once activated, an eligible Global Administrator can do everything a standing Global Administrator can do—until the activation window ends and PIM removes the temporary active assignment.

Duration flavors

• Permanent eligible — always allowed to request activation
• Time-bound eligible — can activate only between start and end dates
• Permanent active — always privileged (use sparingly; emergency/break-glass patterns differ)
• Time-bound active — privileged only during a fixed calendar window without activation

Activation Workflow

When a user is eligible:

1. User opens PIM and selects the role (or receives a deep link from notification)
2. User chooses an activation duration within the admin-configured maximum
3. User provides a justification (if required)
4. User completes MFA if role settings require MFA on activation
5. If approval is required, the request sits pending until an approver approves or denies
6. On success, PIM creates a temporary active assignment within seconds
7. On manual deactivation or timeout, PIM removes the active assignment within seconds

Role settings you will configure (and be tested on)

• Maximum activation duration (for example, 1–8 hours)
• On activation, require MFA
• Require justification
• Require approval + list of approvers
• Require ticket information (ITSM integration patterns)
• Notification options for assignees and admins

Exam trap: MFA required for activation is separate from Conditional Access MFA at sign-in. A user might already have a session, yet still need MFA again when elevating into Global Administrator if the PIM role setting requires it.

Microsoft Entra Roles vs Azure Resource PIM

SC-500 candidates must know these are related but not identical scopes:

Privileged Role Administrators manage Entra role assignments in PIM. They do not automatically see or manage Azure resource role assignments. Azure resource PIM is managed by people who already control Azure RBAC at that scope.

Highly privileged Entra roles (know the pattern)

• Global Administrator — broadest tenant control; minimize standing assignments
• Privileged Role Administrator — can manage role assignments and PIM for Entra roles (itself highly privileged)
• Security Administrator, User Administrator, Exchange/SharePoint/Intune admin roles — prefer eligible + least privilege over GA

Microsoft guidance: reduce permanent Global Administrators; use specific admin roles with PIM eligibility instead of “everyone is GA.”

Just-in-Time and Least Privilege

Just-in-time (JIT) means privileges exist only for the activation window needed to complete a task. Pair JIT with least privilege:

• Prefer User Administrator over Global Administrator for identity lifecycle tasks
• Prefer Contributor on one resource group over Owner on the subscription
• Prefer eligible over active for any role that is not continuously required
• Prefer time-bound eligibility for contractors and project-based access

Access Reviews

Access reviews in Entra ID Governance force periodic attestation:

• Review who is eligible or active for privileged roles
• Reviewers (managers, security, or the users themselves) approve, deny, or mark don’t know
• Denied or incomplete decisions can auto-remove access after the review ends

For SC-500 scenarios: if the question asks how to ensure admins still need elevated roles quarterly, the answer is access reviews on privileged role assignments—not Conditional Access alone.

Extend, Renew, and Approvals

Near expiry of a time-bound assignment, users can request extend. After expiry, they request renew. Both typically need Privileged Role Administrator or Global Administrator approval for Entra roles. Approvers see pending activation requests, can approve/deny in bulk, and must often supply justification for the decision.

SC-500 Scenario Patterns

Common Exam Traps

1. Eligible means powerless until activation — correct. Do not confuse “eligible” with “already admin.”
2. After activation, permissions equal active assignment — correct for the activation window.
3. PIM for Entra roles ≠ automatic Azure RBAC PIM rights — different management planes.
4. Active assignment is not “more powerful” than eligible — only always-on vs on-demand.
5. Access reviews govern ongoing need; activation approval governs a single elevation event.

Implementation Checklist for the Exam

1. Identify standing privileged users (especially Global Administrators)
2. Convert non-emergency admins to eligible
3. Configure role settings: MFA, justification, max duration, approval where risk is high
4. Assign approvers who are available and not solely the same elevated population
5. Enable access reviews on privileged roles and groups
6. Document break-glass accounts separately (often permanent active, excluded from Conditional Access MFA policies that could lock you out—covered in the next section)
7. Monitor activation and assignment audit logs

PIM is how SC-500 expects you to operationalize least privilege for human admins. Next, Conditional Access adds real-time access decisions based on risk, device, location, and authentication strength—often combined with PIM so elevation and daily sign-in both enforce strong controls.