Privileged Identity Management
Eligible vs active · Activation settings · Approval · Access reviews of roles
Practice questions for this topic →
Eligible vs active
| Eligible | Active | |
|---|---|---|
| Access | Just-in-time: activate when needed | Standing |
| MFA, justification, approval | Enforced at activation | Not applicable |
| Duration | Activation 1–24 hours; assignment can be time-bound | Often permanent or time-bound |
| Use for | All privileged roles | Break-glass accounts only |
PIM covers Entra roles, Azure resource roles and PIM for Groups. Role settings are per role and per resource and are not inherited to lower scopes. Requires P2 or ID Governance.
What PIM does
- Just-in-time privileged access; time-bound assignments with start and end dates; approval to activate; MFA on activation; justification; notifications; access reviews of role holders; downloadable audit history.
- Who manages assignments: Entra roles: Privileged Role Administrator or Global Administrator. Azure roles: subscription administrator, resource Owner or User Access Administrator.
- PIM prevents removal of the last active Global Administrator and Privileged Role Administrator assignments. An assignment can't last less than 5 minutes or be removed within 5 minutes of being created. A guest assigned a built-in Entra role gets the same permissions as a member user.
- PIM for Groups (formerly Privileged Access Groups): just-in-time group membership or ownership; each group has two policies (membership and ownership). For groups that elevate into Entra roles, require approval and create them as role-assignable.
- ABAC conditions can be added to eligible assignments, currently for the Storage Blob Data Contributor, Owner and Reader roles.
Exam Tips
Tick each tip once you can answer it without looking.
“Admins get Owner only when needed, for up to 4 hours, with approval” → PIM eligible assignment + approval + max activation 4 h.
“Record why each admin elevated” → PIM: require justification (and ticket info) on activation.
“Contractor needs a role that ends automatically on a date” → PIM assignment with an end date.
“Periodically confirm who still needs Global Administrator” → Access review of PIM role assignments.
“JIT membership for a group that grants many permissions” → PIM for Groups.
“PIM settings set at subscription also apply to resource groups?” → False: role settings aren't inherited.
“Alert when roles are assigned outside PIM” → PIM alerts / security alerts.
“Who manages PIM assignments” → Entra roles: Privileged Role Administrator or Global Administrator. Azure roles: subscription administrator, resource Owner or User Access Administrator. Trap: Others can view but not manage.
“Built-in PIM protections” → Can't remove the last active Global Administrator or Privileged Role Administrator; assignments last 5 minutes at minimum. Trap: A guest given a built-in Entra role gets member-level permissions.
“PIM for Groups” → Just-in-time group membership or ownership with two policies per group; formerly Privileged Access Groups. Trap: For role-elevating groups, require approval and use role-assignable groups.