7.4 Managing Entra ID Roles in PIM

Managing Entra ID Roles in Privileged Identity Management (PIM)

Microsoft Entra Privileged Identity Management (PIM) is an Entra ID feature (requires Entra ID P2, or a bundle that includes it such as Microsoft 365 E5) that provides time-bound, approval-based, just-in-time activation of privileged Entra roles. PIM also provides access reviews, alerts, and audit history for privileged access. The core idea: replace standing privileged access with eligible access that must be activated when needed, shrinking the window in which a compromised account can do damage.

Eligible vs Active Assignments

PIM distinguishes two assignment states:

• Eligible assignment — the user is authorized to activate the role when needed but does not hold it permanently. Until activation, the user has none of the role's permissions.
• Active assignment — the user holds the role persistently (standing access). Active assignments are still tracked in PIM and can be subject to access reviews and alerts, but they do not require activation.

Microsoft's recommendation is to make privileged admins eligible rather than active, then require them to activate for a specific task. A common pattern: 12 eligible Global Administrators who each activate for 2–4 hours when they need to make a change, instead of 12 permanent Global Administrators.

Activation Process

When an eligible admin needs a role, they activate it from the PIM portal (My roles → Activate) or via Microsoft Graph. A typical activation requires:

1. Multi-factor authentication — the user completes MFA at activation time, independent of any prior session MFA.
2. Justification — a short reason for the activation, recorded in the audit log.
3. Approval (optional, configurable) — if the role requires approval, one or more approvers must approve before the role is granted. If no approval is required, activation is self-service after MFA + justification.
4. Ticket / incident reference (optional) — some organizations require a change or incident ticket ID.
5. Time limit — the activation is valid for a bounded duration, after which the role is automatically revoked.

The admin can extend an active activation if still needed (within configurable limits), but cannot exceed the role's configured maximum activation duration.

PIM for Entra Roles vs PIM for Azure Resources

PIM has two planes: PIM for Entra roles (directory roles like Global Administrator, User Administrator, Security Administrator, Privileged Role Administrator) and PIM for Azure resources (RBAC roles scoped to management groups, subscriptions, and resources such as Owner, Contributor, Reader). The MS-102 blueprint scopes PIM to Entra ID roles — focus your study there. The mechanics (eligible/active, activation, access reviews) are similar across both planes, but the scope and the role definitions differ.

Role Settings

For each Entra role managed in PIM, administrators configure role settings:

These settings are the primary control surface for governing privileged activation. Sensible defaults for Global Administrator, for example, are MFA + justification + approval + a short maximum duration (e.g., a few hours). Lower-privilege roles like Security Reader may need only justification, no approval.

Alerts and Access Reviews

PIM generates alerts that surface risky patterns:

• Admins outside PIM — flags accounts that hold the role as a direct (non-PIM) Entra assignment, bypassing PIM governance. This is the most important alert; it identifies the gap between your intended PIM-only model and reality.
• New eligible assignments — notifies when someone is newly made eligible for a privileged role.
• Eligible assignments not activated in N days — surfaces stale eligibilities that can be revoked.
• Duplicate eligible assignments — flags users with redundant eligibilities.

Access reviews let you periodically recertify eligible admins. A review owner (or the users themselves via self-review) confirms whether each eligible admin still needs the role. Reviewers can renew, remove, or deny eligibilities; denied eligibilities are revoked at the end of the review. Microsoft recommends quarterly reviews for high-privilege roles like Global Administrator and at least annual reviews for all privileged roles.

Putting It Together

The PIM workflow reduces standing privileged access dramatically: instead of 12 permanent Global Admins, you have 12 eligible Global Admins who activate for a few hours when they need to make a change. Combined with role-assignable groups (PAGs) for the eligibility container and Administrative Units for scope (where the role supports AU scoping), this is the Microsoft-recommended pattern for governing Entra privileged access on the MS-102 exam. The three pieces work together: PAGs hold the role, AUs scope the role to a subset, and PIM makes the assignment eligible and just-in-time.